JPH03162152A - Portable cipher key storage device - Google Patents

Abstract

PURPOSE:To facilitate the disclosure key management and to improve the system efficiency by holding separately only a disclosure key of the other user used frequently in each user in a small scale list in addition of storage of a secret key. CONSTITUTION:A portable cipher key storage device (IC card) 7 is provided with a storage means 10 having a disclosure key storage area 10A of a comparatively small capacity which stores a secret key of the own device, and also, can store plural disclosure keys of the other device to which a communication is executed frequently. Accordingly, when the disclosure key of only the other device to which a communication is executed frequently is stored in the disclosure key storage area 10A of this storage means 10, a cipher communication can be executed to the other user by only the own disclosure key in many cases. In such a way, the management of the disclosure key is facilitated, and the system efficiency can be improved.

Description

DETAILED DESCRIPTION OF THE INVENTION [Purpose of the Invention (Field of Industrial Application) The present invention relates to a portable cryptographic key storage device used by being connected to a user terminal of an information communication system that handles public key cryptography.

(Prior art) In various information communication systems, it is important to authenticate various things such as who wrote the message, whether the message has not been tampered with during communication, and whether the person communicating with the message is the same person. It is a requirement. Furthermore, data confidentiality, which prevents data from being read illegally from communication lines or storage media, is becoming increasingly important.

Cryptographic technology, especially public key cryptographic technology, can be cited as a way to realize this type of authentication and confidentiality function.

This technology is an encryption method that uses two types of keys: a private key that is unique to a specific user or device, and a public key that is open to an unspecified number of users or devices. A ciphertext created using a public key can be decrypted using a private key, and finding the corresponding private key from the public key is computationally difficult.

The most famous and promising method among public key cryptographic techniques is RSA (R1vest-Shamir-^formerly em.
an ) method is mentioned.

The RSA encryption method uses the following calculation formula (1) where the communication partner's public key is (e, n), the private key is d, M is plaintext, and C is ciphertext
) and (2), encryption and decryption are performed.

C-Ml! lod n
=il) M − C dIlod n
=12) In order to guarantee the security of RSA encryption, n and d need to have a size of about 150 decimal digits (512 bits). e can be quite small, 1-0 base 10
A digit (20 bits) is sufficient.

In the above equation, (1> is the encryption operation, and (2> is the decryption operation.) Conversely, when the plaintext is C, creating the ciphertext (signature text) M by the operation of equation (2) is the digital It is called a signature. In this case, the operation in (1) corresponds to verifying the signature. In either case, only those who know the private key d can perform the operation in equation (2).

FIGS. 5 to 7 show three examples of configurations of information communication systems using RSA cryptography.

The system shown in FIG. 5 connects a management center 2 and a large number of terminals 3 to a network 1, and connects an IC card 4 as a private key storage device to each terminal with or without contact. A public key list 5 in which public keys of all members are stored is provided in the center 2.

In this system, each user maintains a list of all other users' public keys, similar to a telephone directory, and although it has the advantage of allowing users to freely search their own public key list 5, new users Every time you join the system,
Another drawback is that every time a user changes his or her own public key, everyone's public key restructuring must be changed.

The system shown in FIG. 6 is a system in which the public key list 5 is provided only in the management center 2, and the management center 2 centrally manages public key restructuring. In this system, the public key list 5 is centrally managed in one place, making it easy to change the list, but each user must access the public key restructuring in the management center 2 every time they need the public key of their communication partner. Therefore, there is a drawback that the load is concentrated on the management center 2.

The system shown in FIG. 7 is a method that eliminates the public key restructuring shown in FIGS. The public key stored in the memory 6 of the card 4 is sent to the user. This system has the advantage that the public key list is eliminated and does not need to be managed, but has the disadvantage that the public key cannot be obtained unless the communication partner is in standby mode.

In the system examples shown above, in any case, the terminal 3 uses an IC card 4 for holding a private key. The reason why the IC card 4 is used as a private key storage device is mainly because it has the following advantages.

■ Access to IC cards can be controlled by password checking, and use by unauthorized users can be excluded.

■ IC cards are excellent in terms of portability and can be used in any computer terminal equipped with an IC card reader/writer.

■ It is difficult to disassemble an IC card and read out the information stored inside it.

By the way, in the above information communication system, there is a problem of "spoofing" by a third party.

For example, in the system shown in FIG. 7, if user A sends a request signal for a public key (eB.ne) to user B, then user C, who intercepted this request signal, will receive his own public key. If (ec + nc) is sent to user A under the guise of user B, user A will be fooled into thinking that user B's public key has been sent. At this time, user A
The ciphertext C created by user B is Mmodnc
Therefore, it is decrypted by user C who has the decryption key dc.

As a way to deal with this kind of spoofing problem, ko
The method shown by hnf'elder ("A M
method for Certificatlon,-
HIT Lab. for Coo+puLerSc
ience, Cambridge, Mass. (197
8)). In this method, for example, as shown in FIG. 7, the management center 2 digitally signs a user ID and a user public key, and uses the signature as a public key certificate. The user who has obtained the public key of the other user and the public key certificate of the center 2 can confirm the validity of the user public key by inspecting the certificate using the public keys eo and no of the management center 2.

Assuming that RSA encryption is used, specific usage of shadow type signatures and imprint type signatures will be explained. The private key of management center 2 is do, the public key is (eo
, no), the ID of user i is 101, and the public key is (
el, nl).

[Shadow type signature] First, user i's public key certificate C created at center 2
erti is expressed by the following formula.

Certl-(101,el.n1)do mod n
o = −<3> message ( ldl, el.
Since n1) is close to random data, this message is appropriately formatted, redundancy is added, and a digital signature is attached to the data. Note that if the size of the data formatted in this manner exceeds the size of the modulus number, it is divided into two blocks and a digital signature is applied to each block.

The certificate Certi sent to the user is checked using the following formula.

Data= (lDi, ei, ni
) − CertImod no − (
4) Therefore, confirm that the format of the certificate Cert i matches the format and that IDi matches the number 10 of the other user, and send the other party's public key (ei
, n1) can be obtained.

In this method, the other party's public key can be obtained using only the certificate Certi. However, usually the message (l
Di, ei, nl) is given approximately 1.5 times the redundancy, so the size of the certificate Certl is approximately 1.5 to 2 times the user public key information (IDi, el, ni).

[Imprint-type signature] In this method, a collision-free one-way function f is used to create a message (l
Di. ei, nl) is hashed (compressed). of)
The digitally signed certificate for the tush result is set as user i's public certificate Certi, and this certificate Gerti and the public key information (10 i , el, n[) are set as user i's public certificate Certi.
Send the public key to users who need it.

dO CertI - '(lD1.ei.nl) ff
lod no =・(5) The user who received the certificate Certi and the public key information (101, el.n1) hashed this public key information and hashed the result f(IDi, e
l,nl) and the certificate Certl using the following equation (6>d), and confirm that they match, and obtain the public key ei,nl of user i.

r(101,el,ni) -Certi a+
od no - (6) In this method the certificate cert
The size of I matches the size of public key no of center 2,
Normally, the size of user's public key information (IDi.el, n1) is larger than the size of center 3's public key, so the size of the certificate certt itself is user i's public key information (lDi, ei, nl). will be smaller than the size of. However, when inspecting a certificate, public key information (I[)i, el, nl) is required in addition to the certificate, so the size of the certificate is actually about 1.5 times larger. FIG. 8 shows a conceptual diagram of the public key list I-5A owned by the management center 2 when an imprint type signature is used. As shown in the figure, three items are recorded in this restructuring A: ID information, public key data, and public key certificate.

As explained above, Kohnfelder's method can prevent impersonation by a third party, but the size of the public key certificate is 1.5 times larger than the size of the original user public key.
It becomes about twice as large. Therefore, if you manage this certificate as a list, the size of the list will increase and
There is also the problem that the amount of communication increases if the other party sends a message each time the communication is made. Another problem is that the amount of processing on the user side increases because the certificate must be verified every time the other party's public key is needed.

(Problem to be solved by the invention) As mentioned above, with the various conventional public key management methods, it is not easy to update the public key list, and the load is concentrated on the public key management center. or the public key cannot be obtained unless the other party's terminal is in standby mode,
The problem is that the size of the public key list due to public key certificates increases, and the public key certificate must be inspected every time the other party's public key is needed, making public key management difficult and system efficiency low. was there.

SUMMARY OF THE INVENTION Therefore, an object of the present invention is to provide a portable cryptographic key storage device that can easily manage public keys and improve system efficiency.

[Configuration of the Invention (Means for Solving the Problems) The portable encryption key storage device of the present invention that solves the above problems includes:
In a portable cryptographic key storage device 7 used by being connected to a user terminal of an information communication system that handles public key cryptography,
A user confirmation means 8 for confirming the validity of the user, a communication means 9 for communicating with other devices, and a device 7 for storing a private key unique to the own device 7 and communicating frequently with the other device. Public key storage area 10 that can store multiple public keys
A and the communication partner's public key stored in the storage means 10 are used to perform appropriate encryption processing, and the communication partner's public key and its validity proof information are transmitted via the communication means 9. input f. When the validity of the validity certificate is determined by the calculation means 11, the control procedure is configured to be unchangeable, and when the validity of the validity certificate is determined by the calculation means 11, the public key of the communication partner is The present invention is characterized in that it includes a control means 12 that enables writing of the public key storage area 10A of the storage means]0.

(Function) The portable cryptographic key storage device of the present invention stores the private key of its own device and also stores the public keys of the other device with which it communicates frequently. A storage means 10 having a relatively small capacity public key storage area 10A is provided. Therefore, the public key storage area 10 of this storage means 10
If the public key is stored only in the partner device that frequently communicates with A, in many cases it is possible to perform encrypted communication with other users using only the public key that A has.

In addition, in the present invention, the public key and its validity proof information sent from other users or the management center are manually collected,
After determining its validity, the public key is stored in the storage means 1.
It is equipped with arithmetic means 11 and a control means 12 that are capable of writing into the public key storage area 10A of 0, and the control procedure of the control means 12 is configured such that its contents cannot be changed. Therefore, only when it is thought that the other user's public key that is not stored in the own device 7 will be needed frequently in the future, the other user's public key is recorded to the extent that it can be stored in the public key storage area 10A of the storage means 10. You can go there. Moreover, at this time, the writing procedure is not limited in the present invention, so
When the storage capacity of the public key storage area 10A becomes full, various applications can be made, such as updating the least frequently used public key among the plurality of stored public keys with the next new public key.

(Example) Examples of the present invention will be described below.

Fig. 1 is a block diagram of a portable encryption key storage device according to an embodiment of the present invention, Fig. 2 is an explanatory diagram showing the storage contents of a public key storage area, and Fig. 3 shows an example of the structure of an application system. It is an explanatory diagram.

In FIG. 1, the encryption key storage device 7 of this example is configured to be portable using an IC card, and includes user confirmation means 8 for confirming user authenticity, and communication means for communicating with other devices. 9, a storage means 1o having a public key storage area 1-OA capable of storing a private key unique to the own device 7 and a plurality of public keys of the other device with which communication is frequently performed; a calculation means 11 for checking the validity of the validity proof information when the public key of the communication party and its validity proof information are input manually via the communication means 9 using the public key of the communication party; and a control procedure; is configured to be unchangeable, and when the validity certificate is determined by the calculation means 1, the public key of the communication partner can be written into the public key storage area 10A of the storage means 10. 12
It consists of:

In the above, the user verification means 8 verifies the authenticity of the user by swath verification, fingerprint verification, or the like.

The communication means 9 is for communicating with an external computer via an IC card reader/writer.

The storage means 10 is composed of an E2PROM as a non-volatile memory, and has a public key storage area 1. OA is memorized. However, the control program for the control means 12 is stored in a read-only, non-rewritable ROM.

As shown in FIG. 2, in the public key storage area 10A, frequently used public keys are stored together with IDs within a limited storage capacity.

The calculation means 11 can perform multiple precision calculations required for RSA cryptographic processing, and performs processing such as digital signatures and encryption using the other party's public key.

Next, the system shown in FIG. 3 corresponds to the system shown in FIG. 6, in which a management center 13 and a large number of terminals 3 are connected to a network 1.

The aforementioned encryption key storage device 7 can be connected to each terminal 3, and a public key list 14 in which public key information and public key certificates of all subscribers of the system are registered is connected to the management center 13.

The management center 13 performs the tasks of writing and issuing each user's private key and the public key of a user designated as frequently used by the user into the encryption key storage device 7, and publishing the public key of each user. Creating a key certificate, registering it in the public key list 14, and managing the public key list 14;
It is responsible for receiving a public key transmission request from a user and transmitting the corresponding public key information and public key certificate.

The method for registering the other party's public key is shown in a flowchart in FIG. This process is started based on a request when the public key of the other party to communicate with is not stored in the public key storage area 10A.

First, in step 401, a request for transmission of the other party's public key is output, in step 402, the public key and certificate are received from the management center 13, and in step 403, they are inspected using the same inspection method as shown in the prior art.

The inspection result is determined in step 404, and if the iE validity of the certificate is determined, it is determined in step 405 whether or not there is space in the public key storage area, and if there is space, it is registered in step 406.

On the other hand, if the validity of the certificate is not recognized in step 404, the process moves to step 407 and the public key is not registered.

In addition, if it is determined in steps 404 to 405 that the certificate is valid but there is no free space in the public key storage area 10A, in step 408 it is determined whether or not the public key registration command has been manually entered. Separate.

This public key registration command is specified by the user.For example, for a user who is expected to use the public key frequently in the future,
This specifies that the information should be registered.

Therefore, if the registration command is manually issued in step 408, the process moves to step 401 and the public key is registered. However, at this time, since there is no free space in the public key registration area 10A, only one public key that is used infrequently or that has not been used for a long time is deleted.

If no particular registration command is input in step 408, the public key is assumed to be used only this time and is not registered in the public key storage area 10A.

The procedure shown in FIG. 4 is set as a program and written in a dedicated ROM, so that it will not be attacked by computer viruses.

Therefore, the public key written in the encryption key storage device 7 is
The public key information and public key certificate for the same user ID are received again, and the control is performed so that rewriting is not possible unless the inspection result of the public key certificate is normal.

When changing the public key, for example, the management center 13 issues a public key certificate corresponding to the new public key data, and sends the public key data and public key certificate to the user with whom the user frequently communicates, and controls the data. An update command may be given to the means 12.

Encryption using the other user's public key recorded in the encryption key storage area 10A and checking of the digital signature are performed using the calculation means 11 within the own device 7. Encryption key storage device 7
In order to speed up the cryptographic processing carried out internally, for example, there is a method of incorporating cryptographic processing hardware into the cryptographic key storage device 7 as the calculation means 11, but it is also possible to show secret information such as a private key to an external terminal. It is also possible to borrow the computing power of external terminals by using "request calculation" as a method to shorten the processing time of encryption processing. Request calculation procedures that can be used when using RSA encryption as cryptographic processing are shown in the following three documents, for example.

[Reference 1 Mitsunori Kato, Tsutomu Matsumoto, Hideki Imai, “On a secure calculation request method”, 1988 Cryptography and Information Security Symposium Materials.

[Reference 2] Tsutomu Matsumoto, Hideki Imai “How to request services without revealing secrets”, l! 389 Cryptography and Information Security Symposium Materials.

[Reference 3] Shinichi Kawamura, Jun Shinbo. “Secret conversion of RSA encryption by request calculation”, 1989 Cryptography and Information Security Symposium Materials.

As described above, according to the portable encryption key storage device 7 of this example,
Of course, it is possible to fully utilize the characteristics of IC cards,
Since the list contains only the public keys of multiple users who frequently communicate with each other, the size of the user list can be significantly reduced.

In addition, since several public keys of other users are stored in the encryption key storage device 7, access to the center list or the other party terminal is only made when the necessary public key is not registered in the encryption key storage device 7. This will greatly improve the efficiency of communication line usage.

Also, for media without access control capabilities, such as floppy disks, the information on the disk can be easily rewritten, so the public key certificate must be written along with it. When recording on a medium with access control capability, such as an IC card, it is difficult to rewrite the information. Therefore, if the public key certificate is used for checking when writing public key information for the first time, it becomes unnecessary for subsequent processing. Therefore, there is no need to record the public key certificate, and the storage area can be reduced by the amount of data of the public key certificate.

The present invention is not limited to the above-mentioned embodiments, and can be implemented with appropriate modifications without departing from the gist thereof.

[Effects of the Invention] As described above, the present invention provides a mobile phone in which, in addition to storing private keys, only public keys of other users that are frequently used by each user are individually held in a small list. Since it is a cryptographic key storage device for use in any conventional information communication system, public keys can be easily managed and system efficiency can be improved.

[Brief explanation of the drawing]

FIG. 1 is a block diagram showing an embodiment of the portable encryption key storage device according to the present invention, FIG. 2 is an explanatory diagram showing the storage contents of the public key storage area of the encryption key storage device, and FIG. 3 is the above An explanatory diagram showing an example of the configuration of an information communication network using an encryption key storage device, FIG. 4 is a flowchart showing the procedure for registering the other party's public key in the encryption key storage device, and FIG. 5 is a conventional method using public key cryptography. Figure 6 is a diagram showing another configuration of a conventional information communications network using public key cryptography, and Figure 7 is a diagram showing yet another configuration of a conventional information communications network using public key cryptography. One configuration diagram, FIG. 8, is a conceptual diagram of a conventional public key list. 7... Portable encryption key storage device (IC card) 8...
User confirmation means 9... Communication means 0... Storage means OA... Public key storage area 1... Calculation means 2... Control means

Claims (1)

[Claims] In a portable cryptographic key storage device used by being connected to a user terminal of an information communication system that handles public key cryptography, a user confirmation means for confirming user authenticity, a communication means for communicating with other devices, and , a storage means having a public key storage area capable of storing a private key unique to the own device and a plurality of public keys of the other device with which communication is frequently performed; a calculation means that performs an appropriate encryption process using a public key and checks the validity of the validity proof information when the communication partner's public key and its validity proof information are input via the communication means; and a control unit. The procedure is configured to be unchangeable, and the control means is configured to enable writing of the public key of the communicating party into the public key storage area of the storage means when the validity of the validity certificate is determined by the calculation means. A portable encryption key storage device characterized by: