JPH01200846A - System for distributing cipher key in network system - Google Patents

Abstract

PURPOSE:To prevent loading a cipher key on the communication path and to reduce a hazardousness that the cipher key is plagiarized by ciphering the cipher key itself to be used for transmitting and receiving data and distributing it. CONSTITUTION:A cipher key K decided by a data processing system 10 is ciphered through a ciphering mechanism 11 by a node key N1 to a cipher key K' and sent on the communication path. When the cipher key K' is received by a data processing system 20, the cipher key K' is decoded through a decoding mechanism 22 by a node key N2 to a cipher key K'' and transmitted to the system 10. At the system 10, the cipher key K'' is decoded through a decoding mechanism 12 by the node key N1 to a cipher key K'''. In the course, the ciphering by the node key N1 is offset. At the system 20, by decoding the cipher key K''' through a ciphering mechanism 21 by the node key N2 to a cipher key K'''', the cipher key K to be decided by the system 10 first can be obtained.

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Industrial Application] The present invention relates to a data processing network system, and particularly to a method for delivering an encryption key for encrypting data on one communication path.

[Conventional technology]

Conventionally, this type of encryption key distribution method has either delivered the encryption key itself on a communication path, or

Deliveries were made offline using media, etc.

[Problem to be solved by the invention]

The above-mentioned conventional encryption key distribution method has the drawback that the encryption key is left on the communication path as is, making it easy to steal.

On the other hand, even if the data is delivered offline using a medium such as a floppy disk without using a single communication channel, it is possible that the data will be stolen, and the encryption key may need to be changed.

This is a difficult reminder compared to using a communication channel.

The disadvantage is that the system lacks flexibility.

[Means to solve the problem]

A cryptographic key distribution method in a network system according to the present invention is a cryptographic key distribution method for encrypting data on a communication path in a network system that exchanges data between a plurality of data processing systems. is characterized by having an encryption mechanism 2 that encrypts the encryption key and sends the encrypted encryption key onto the communication path.

〔Example〕

Next, embodiments of the present invention will be described with reference to the drawings.

FIG. 1 shows the system of the present invention, in which a data processing system 10 and a data processing system 20 each include:
It has an encryption mechanism 11.21 and a decryption mechanism 12.22, which are connected by nine communication paths.

FIG. 1 shows the process in which the encryption key K determined by the data processing system 10 is delivered to the data processing system 20, and the double line portion shows the flow on one communication path. The encryption key determined by the data processing system 10 is sent out onto the communication path using the node key N1 that the data processing system 10 has uniquely.

K'= to @Nl
...(1) Here, encryption is [F], decryption is [F]
F] is abbreviated as the formula.

When the data processing system 20 receives the first encrypted encryption key /+, it is transferred to the decryption mechanism 22 using the node key N2 (which may be different from Nl) unique to the data processing system 20. is decrypted into a first decrypted encryption key K'' as shown in equation (2), and transmitted to the data processing system 10.

K//= to'[F]N2=@NI[F]N2
...(2) Next, in the data processing system 10, '' is added to the first decrypted encryption key, and node key N is added to the first decrypted encryption key.
1, it is decrypted to a second decrypted encryption key K'' via the decryption mechanism 12 as shown in equation (3). In this process, the encryption by the first node key N1 is canceled out.

K'''=N1=K[F]N1■N2[F]N1=N2...(3) The data processing system 20 uses this second decrypted encryption key as /#-t, Via the encryption mechanism 21.

By encrypting with the node key N2 into a second encrypted encryption key K"" as shown in equation (4).

First, the cryptographic key Ki determined by the data processing system 1o can be obtained.

K” = に′′@N 2= に@N 2@N 2=K
- (4) [Effects of the invention] As explained above, the present invention encrypts and delivers the encryption key itself used for sending and receiving data, thereby preventing the encryption key from being transmitted as is on the communication path. This has the effect of reducing the risk of encryption keys being stolen. However, each data processing system has a unique node key (not negotiated between systems).

There is no need to tell the data processing system of the other party, and a highly secure and flexible network system can be constructed.

[Brief explanation of the drawing]

FIG. 1 is a block diagram showing the configuration of a cryptographic key distribution method in a network system according to an embodiment of the present invention. lO...Data processing system, 11...Encryption mechanism. 12...Decoding mechanism, 20...Data processing system. 21... Encryption mechanism, 22... Decryption mechanism.

Claims (1)

[Claims] 1. In a cryptographic key delivery method for encrypting data on a communication path in a network system that exchanges data between multiple data processing systems, each of the data processing systems encrypts the cryptographic key and performs encryption. 1. An encryption key distribution method in a network system, comprising an encryption mechanism that sends an encoded encryption key onto the communication path.