JPH10200520A - Key management method and system - Google Patents

Abstract

(57) [Summary] [Problem] When the enforcement agency 5 performs ciphertext decryption, it is limited to within the prescribed range. SOLUTION: System secret keys Ss ₁ and Ss ₂ and user secret information Si ₁ and Si ₂ are registered in key management institution devices 3 and 4, and at the time of encrypted communication, a transmitting user 1 uses a master key Kab and date and time information D at the time of encrypted communication. , Kd = g ^KabD (modn), encrypts the message encryption key Ks with Kd to create data LEAF, and the receiving user 2 creates Kd in the same manner as user 1, and uses this Kd to create LEAF. Decrypt to obtain Ks. Institution 5
When decrypting, the institutions 3 and 4 receive Kab, D and random numbers R ₁ ,
Create a key K _1, K ₂ by using the R ₂ provides to the engine 5, engine 5 is to generate a key K ^* = K ₁ · K ₂ from K _1, K _2,
The engines 3 and 4 are sent, and the engines 3 and 4 prepare to delete R ₁ and R ₂ from K ^* , respectively, and send K ₁ ′ and K ₂ ′ to the engine 5, and the engine 5 sends K ₁ ′ and K ₂ ′. Make Kd from
Decrypts the LEAF to obtain Ks.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a cryptographic communication system, which is capable of decrypting a cipher text stored in a database or the like during communication or a session key for decrypting a cipher text, based on a law or a contract. Enforcement authority authorized to decrypt ciphertexts or duplicate session keys only to the extent of its provisions, and at the same time deviate from such provisions Or a key management method and system for preventing the privacy of a user (user) from being violated by duplicating a session key.

[0002]

2. Description of the Related Art In recent years, encryption technology has been widely studied as a fundamental technology for the information society, and extremely strong encryption technology has been developed. On the other hand, as strong encryption technology has been developed, it has become possible to prevent eavesdropping and falsification of communications that have been conventionally regarded as fraudulent, but this time encryption technology itself is used for antisocial acts. Concerns are spreading. However, since the current encryption technology aims to prevent anyone from eavesdropping on communications, even if it is used for antisocial acts, it will not be recognized or caught Can not.

[0003] Also, from the viewpoint of corporate defense, some companies have taken measures such as encrypting and storing important files in the company, but on the other hand, accidents, disasters, and other reasons have occurred. Even if a situation occurs in which an encrypted file cannot be decrypted, there is no longer any means for decrypting the file with the current encryption technology, and the file is permanently unavailable.

[0004] For this reason, technologies for enabling enforcement agencies to decrypt ciphertexts under certain conditions under laws or contracts have been studied mainly in Europe and the United States. These technologies are called key recovery or key escrow. being called. These technologies generally use LEA after encrypting a session key used when using encrypted communication.
F (Law Enhancement Access Field), etc., stored in the additional data and added to the ciphertext, and when a permission to decrypt the ciphertext is issued by a court order or contract, the enforcement agency sends the session key from the additional data. It is intended to be able to recover and decrypt the ciphertext. A typical example is Escrowed E, which is proposed by the U.S. government.
ncryption Standard (Federal Information Processing
Standards Publication (FIPS) 185, USDept. Of Commer
ce).

FIG. 6 shows an outline of the operation of the Escrowed Encryption Standard. According to this method, a user performs cipher communication using a clipper chip that is a tamper-resistant chip. This clipper chip has SKIPJ
A plurality of algorithms such as a secret encryption algorithm called ACK, a secret generation algorithm and a verification algorithm of LEAF, and a plurality of device-specific or system-common data such as a device number, a unit key, and a family key are enclosed. Since this chip is a mechanism that is allowed to be manufactured only at manufacturing plants that have been approved by the US government due to confidentiality policies aimed at securing the communication interception function, the specific configuration is not disclosed, only the operation summary is published Have been.

According to this operation summary, first, the manufacturing factory 11
, While enclosing the algorithm and data in each clipper chip and distributing it, divides the unit key into two pieces of data and deposits them together with the device number in two escrow agencies 12 and 13 specified by law. next,
When the user performs cryptographic communication in a situation where the session key is shared in advance by any method, the sender A
Sends the session key and message to the clipper chip 15
Input to A. The clipper chip 15A encrypts the message using the session key with the encryption unit 16 using the SKIPJACK algorithm, and simultaneously encrypts the session key with the unit key and family key together with the device number and some secret data using the secret generation algorithm. The encrypting unit 17 generates the LEAF. The ciphertext and LEAF generated in this way are transmitted to the communication partner.

[0007] Further, the receiver B inputs the session key, the received ciphertext and the LEAF to the clipper chip 15B. The clipper chip 15B first verifies the validity of the LEAF by the verification unit 18 using the family key and the secret data, and only when the verification is passed, the ciphertext is decrypted by the SKIPJACK algorithm using the session key using the session key.
Decrypt at 9. If the verification fails, decryption is not performed.

Further, when the law enforcement agency 21 obtains a verification warrant from the court and intercepts the communication, the law enforcement agency 21 presents the verification warrant to the two escrow agencies 12 and 13 so that the law enforcement agency 21 divides the clipper chip 15A. The received data of the unit keys 1 and 2 are received from the respective escrow agencies 12 and 13, and the unit key of the clipper chip 15A is reconfigured by the key reconfiguration unit 22. After that, the LEAF is decrypted by the decryption unit 23 using the family key and the reconstructed unit key to obtain a session key. By using the session key thus obtained, the ciphertext can be decrypted by the decryption unit 24 and the message can be intercepted.

[0009] However, it has been pointed out that this method has some problems. Among them, (1) it is almost kept secret because the basic part of the configuration secures a communication interception function. (2) If the law enforcement agency 21 obtains a court's warrant and intercepts communications at least once, it will acquire a unit key for the device, and thereafter, Can unconditionally intercept the communication in which the device is the oscillating side over the past, present and future, regardless of whether it is within the range permitted by the court. In this case, it is impossible to intercept the communication unless the unit key for the transmitting device is obtained, and if an attempt is made to forcibly intercept the communication, the unit interception for the user's device not included in the verification warrant is performed. Etc. so that the bets key from being disclosed is a major problem. In other words, it is a scheme that places more emphasis on the interests of law enforcement agencies and does not dispel concerns that the risk of privacy infringement by law enforcement agencies is extremely high. In addition, it cannot be ignored that legal control by law enforcement agencies is not effective against illegal interception of communications by law enforcement agencies.

[0010]

SUMMARY OF THE INVENTION An object of the present invention is to protect the user's privacy as much as possible from cipher decryption or session key duplication performed based on a law or a contract. 1) Use public protocols and algorithms. (2) If an enforcement authority performs ciphertext decryption or session key duplication based on laws or contracts, ensure that ciphertexts are used only within the specified range. (3) that the enforcement authority cannot decrypt the ciphertext and duplicate the session key, even if the enforcement authority attempts to decrypt the ciphertext or duplicate the session key illegally beyond the provisions;
(4) A person who does not have authority according to a law or a contract is to provide a key management method and a system that realizes no decryption of cipher text and no duplication of a session key.

[0011]

According to the present invention, as a method for achieving the above object, a system secret key and user secret information generated by a key management organization or a key generation organization or a user or a master key for specifying a communication party are provided. Kab
The key management organization registers and manages the session key, and when performing the cryptographic communication, the transmitting side uses the data including the master key Kab and the date and time information as the session encryption key Kda, and the session key used for encrypting the actual message. A process of generating additional data LEAF by encrypting data including KS with the session encryption key Kd, and decrypting the additional data LEAF using the session encryption key Kd generated by the receiving side in the same manner as the transmitting side. The key management institution obtains the session key KS by using the data including the master key Kab, date and time information, and random number data R ₁ (R ₂ ). pseudo-session encrypted using the provided pseudo master key K ₁ (K ₂₎ the enforcement, enforcement pseudo master key K _1, K ₂ After generating the K ^*, and sending to the key management institutions, K ₁ to erase the key management center random number data R ₁ from the pseudo-session encryption key _{^{K * (R 2) '(}} K 2')
After reconstructing the session encryption key Kd from K ₁ ′ and K ₂ ′, the enforcement agency decrypts the additional data LEAF using the session encryption key Kd to obtain the session key KS. And, if necessary, decrypting the ciphertext using the session key KS. Since the date and time information only needs to include information for determining whether or not the time is within a permitted range based on a law or a contract,
Instead of the actual date and time information, any information may be used as long as the information is temporally distinguished, such as a transmission number and a message number. Furthermore, a plurality of types of such information may be included, and other information, for example, additional data such as a user name of a transmitter / receiver and random number data may be further added.

Further, as a system for achieving the above object, a user apparatus includes a session key generation unit, a master key generation unit, a date and time management unit, a session encryption key generation unit, an additional data generation unit, a session key acquisition unit, The key management institution device has a system secret key management database, a user secret information management database, a random number data generation unit, a pseudo master key generation unit, and a random number data erasure unit. , A pseudo session encryption key generation means, a session encryption key reconstructing means, and an analysis means, and an information generation means for generating a system public key and a system secret key is provided by a key management institution device or a key generation institution device. User information to generate user public information and user secret information or master key Characterized in that it comprises means to the user device or key generation engine apparatus or the key management center apparatus. If necessary, the enforcement apparatus may be provided with an encryption means for decrypting the encrypted text.

[0013]

According to the present invention, it is necessary to obtain the session encryption key Kd in order to obtain the session key KS and decrypt the ciphertext, and the session encryption key Kd is obtained by combining the master key Kab with the date and time. Since it is obtained by using data including information, it is necessary to obtain the master key Kab in order to generate an arbitrary session encryption key Kd.

However, in order to extract the data including the master key Kab and the date and time information from the session encryption key Kd, it is necessary to solve a discrete logarithm problem that is extremely difficult to solve mathematically, and this requires a public key. It is believed to have as much difficulty as decrypting the cryptographic method. Therefore, even if the session encryption key Kd is obtained, it is impossible for an unauthorized party or an unauthorized party to decrypt the session encryption key Kd and extract the master key Kab.

On the other hand, when performing ciphertext decryption or session key duplication, the enforcement authority can obtain the pseudo master keys K ₁ and K ₂ from the key management authority, and obtain the pseudo session encryption key K ^* therefrom. Can be done. However, from the pseudo session encryption key K ^* to the session encryption key Kd
Alternatively, to obtain the master key Kab, it is necessary to delete the random number data managed by the key management organization, and only the key management organization can delete the random number data. Therefore, the key management authority can pass only the session encryption key Kd to the enforcement authority by deleting the random number data from the pseudo session encryption key K ^* without opening the master key itself to the enforcement authority. Further, since the pseudo master key K ₁ (K ₂ ) provided by the key management organization can be generated using only the user secret information of one user or the master key specifying the communication party regardless of the originator or the recipient,
No user secrets or master keys of unscoped users are used. In addition, since the user sends the session key KS using the additional data LEAF, if the additional data is invalid, the users themselves cannot share the session key with each other. Means that valid additional data is used. Therefore, when ciphertext decryption or session key duplication is performed based on laws or contracts, the key management authority checks whether it is within the prescribed range, and only if it is determined to be within the range, the session encryption is performed. Will pass the encryption key Kd to the enforcement authority and the session encryption key K
When d is obtained, since the additional data is valid, the session key KS is always obtained, and the ciphertext can be decrypted.

Further, since the date and time information differs for each communication or each time the session key KS is updated, the session encryption key K
d also differs for each communication or each session key update. Therefore, the session encryption key K obtained by the executive
d is also effective only for the duplication of the session key KS or the decryption of the ciphertext in the case of corresponding to it, and is useless in other cases.

[0017] Therefore, even if the authority does not have authority, even the enforcement authority cannot acquire the master key Kab under any circumstances, so that any session encryption key Kda is illegally generated. As a result, it is not possible for an enforcement authority to deviate from its scope and unfairly decrypt the ciphertext or duplicate the session key.

In the present invention, a system can be configured using a public key cryptosystem and a common key cryptosystem in which algorithms are disclosed.

[0019]

DESCRIPTION OF THE PREFERRED EMBODIMENTS One embodiment of the present invention will be described below with reference to the drawings. FIG. 1 is a functional configuration diagram of a key management system according to an embodiment of the present invention. In FIG. 1, an originating user device 1 includes a user information generating unit 10 for generating user public information and user secret information, and a session key generating unit 1 for setting a session key KS by a user operation.
1. Master key generation means 12 for generating a master key for specifying a communication party, date and time management means 13 for managing information indicating communication date and time, a session for generating a session encryption key for encrypting a session key The system includes an encryption key generation unit 14, an additional data generation unit 15 for generating additional data, and a common key encryption unit 16 for performing encrypted communication. The receiving-side user device 2 includes a user information generating unit 20 that generates user public information and user secret information, and a verifying unit 2 that verifies whether the additional data is valid data.
1. Master key generation means 22 for generating a master key for specifying a communication party, session encryption key generation means 23 for generating a session encryption key for encrypting a session key, and extracting a session key from additional data A session key acquiring unit 24 and a common key encrypting unit 25 for performing encrypted communication are provided.

The key management institution device 3 has an information generating means 30 for generating a system public key and a system secret key, and the key management institution devices 3 and 4 have a system secret key management database 31 for storing and managing system secret keys. User secret information management databases 33 and 43 for storing and managing user secret information; random number data generating means 34 and 44 for generating random number data; pseudo master key generating means 35 and 45 for generating a pseudo master key; Random number data erasing means 36, 4 for erasing random number data from the encryption key
6 is provided. The enforcement agency device 5 includes a storage unit 50 for storing the intercepted ciphertext and additional data, a pseudo session encryption key generation unit 51 for generating a pseudo session encryption key, and a session encryption key for reconstructing the session encryption key. It comprises a reconstructing means 52, an analyzing means 53 for acquiring a session key, and a common key encrypting means 54 for decrypting encrypted communication. Originating user device 1 and receiving user device 2
Are connected to each other by a communication line 6.

Next, the operation method of the above embodiment will be described with reference to the drawings. Here, the RSA encryption (RL Rivest, A. Shamir, L. Adleman,
“A method for obtaining digital signature and pub
lic-key cryptosystem, ”Communication of ACM, vol.
21, No.2, 1978.2). First, an operation method at the time of system construction is shown in FIG.

Step A1: The key management organization device 3 prepares the following information in the information generating means 30. (1) two large prime numbers p, q, (2) n = pq, (3) g,
(4) Rs, (5) Ps, Ss, where M ^PsSs = M (mod n) for any M. Step A2: The key management institution device 3 has n, g, Ps, g
Publish ^{1 / Rs} to all subscribers as a system public key.

[0023] Step A3: Ss to Ss _1, Ss ₂ of divided into _{two, Ps, Ss 1, p,} q, the key to Rs management center apparatus 3
, And Ps, Ss ₂ , p, q, and Rs are strictly stored in the system secret key management database 41 of the key management organization device 4. Here satisfy Ss = Ss ₁ + Ss _2. Note that p, q,
_{Rs, Ss, Ss 1, Ss} 2 is a very important system secret key on the system, it must be kept in strict so that it does not flow out to the outside in any case.

Although the description has been given here assuming that the key management institution device 3 independently generates the system public key and the system secret key, the present invention is not limited to this. Alternatively, the key management institution device 3 and the key management institution device 4 may cooperate to generate the key secret institution, or a reliable key generation institution may generate and distribute the system secret key to the key management institution devices 3 and 4. It is not excluded.

Next, an operation procedure when a user joins the system is shown in FIG. Step B1: The user i enters the user information generating means 10 (2
0), own secret information Si and public information Pi = g
Set ^Si modn. Step B2: Pi secret information Si is divided into two Si _1, Si _2, with respect to the key management center apparatus 3 safely and secretly,
It sends Si ₁ and Pi and Si ₂ to the key management organization device 4. Here, Si = Si ₁ + Si ₂ is satisfied.

Step B3: The key management institution 3 (key management institution 4) strictly stores the information sent from the user in the user secret information management database 33 (43). Here, the description has been made assuming that the user himself generates the user public information and the user secret information. However, the present invention is not limited to this, and instead of the user, the key management institution apparatus 3 (4) or the trusted key may be used. This does not preclude the case where the information is generated by the generating institution and the necessary information is securely and secretly transmitted to the user, the key management institution device 3, and the key management institution device 4.

FIG. 4 shows an operation procedure in the case where the user A and the user B perform encrypted communication. It is assumed that the transmitting side is A and the receiving side is B, and the following steps C1 to C5 are performed by the device A of the user A, and steps C6 to C9 are performed by the device 2 of the user B. Step C1: The session key KS is freely set using the session key generation means 11.

Step C2: Using the master key generation means 12, the master keys Kab = Pb ^Sa = g ^SaSb (mod n) of the users A and B from the user secret information Sa of the user A and the user public information Pb of the user B. Ask for. Step C3: Using the master key Kab and the date / time information D obtained from the date / time management unit 13, the session encryption key generation unit 14 generates a session encryption key Kd = g ^KabD (m
odn). In other words, g is encrypted with Kab and D and Kd
Ask for.

Step C4: The additional data generation means 15 uses the session encryption key Kd to
Additional data LEAF for S = Δf (KS, Kd)
| D | checksum} is generated. Here, f (M, K) is an arbitrary common key cryptosystem f, and represents that M is encrypted with the key K. Also, | indicates concatenation, and checksum is checksum data indicating the validity of the additional data LEAF.

Step C5: The additional data LEAF is sent to the device 2 of the user B via the communication line 6. Step C6: The verification unit 21 verifies the validity of the additional data LEAF using the checksum. If the verification fails, disconnect the communication. Step C7: Using the master key generation means 22, the user secret information Sb of the user B and the user public information P of the user A
From a, the master keys Kab = Pa ^{Sb of} users A and B
= G ^SaSb (modn).

Step C8: The date and time information D is extracted from the additional data LEAF, and the session encryption key generation means 23 ^{obtains a} session encryption key Kd = g ^KabD (modn) using the master key Kab and the date and time information D. Step C9: The session key obtaining means 24 obtains a session key KS = f ^-1 (f (KS, Kd), Kd) from the additional data LEAF using the session encryption key Kd. Here, f ⁻¹ (C, K) is the common key cryptosystem f, and represents that C is decrypted with the key K.

Step C10: The device 1 of the user A and the device 2 of the user B perform encrypted communication through the communication line 6 using the common key encryption means 16 and 25 using the session key KS. Step C11: When one of the user A and the user B wants to change the session key KS, the operation from step C1 is repeated with the session key KS {the user who tried to change the call originating side}.

Finally, FIG. 5 shows an operation procedure in the case where an enforcement agency executes ciphertext decryption or session key duplication based on a law or a contract. Here, it is assumed that the enforcement agency has obtained a permit (for example, a communication interception verification warrant, an inquiry letter, etc.) necessary to execute ciphertext decryption or session key duplication. It is assumed that the received communication data is stored in the storage unit 50. It is also assumed that the user who is the target of the permit is A, and the communication partner at this time is B.

Step D1: The enforcement authority device 5 obtains the key management authority device 3 and the key management authority device 4 from the permit and the additional data LEAF indicating that the ciphertext decryption or the session key duplication is properly executed. The date and time information D is presented. The exchange of data between the key management institution devices 3 and 4 and the enforcement institution device 5 may use a communication line, or may use a communication line other than the communication line.

Step D2: Key management organization device 3 (key management
The institution 4) checks whether the permit is valid.
Authorized and the enforcement authority decrypts the ciphertext or duplicates the session key.
If you are trying to implement
Check if it is within the range described in about etc. range
If it is determined to be outside, reject the request. Step D3: Key management institution device 3 (key management institution device 4)
If it is determined that is within the appropriate range, random number data generation
Random number data R using the means 34 (44)₁(R _Two) Raw
To achieve.

Step D4: The key management organization device 3 (key management organization device 4) splits the system secret key Ss ₁ (Ss ₂ )
, The user secret information Sa ₁ (S
a ₂ ), user public information Pb of user B and random number data R
₁ (R ₂ ), the pseudo master key generation means 35 (4
In 5), the pseudo master key K ₁ = Pb ^Sa1 · R ₁ ^Ps (modn), (K ₂ = Pb ^Sa2 ·
R ₂ ^Ps (modn)) is calculated.

Step D5: The key management institution device 3 (key management institution device 4) sends the pseudo master key K ₁ (K ₂ ) to the executive institution device 5. Step D6: The enforcement agency device 5 uses the pseudo session encryption key generation means 51 to convert the pseudo session encryption key K ^* = K ₁ · K ₂ = Pb ^{Sa1 + Sa2} · R ₁ from the pseudo master key K ₁ (K ₂ ). ^Ps · R ₂ ^Ps = P
b ^Sa · R ₁ ^Ps · R ₂ ^Ps = Kab · R ₁ ^Ps · R ₂ ^Ps (modn)
Is calculated.

Step D7: The enforcement institution 5 sends the pseudo session encryption key K ^* to the key management institution 3 and the key management institution 4. Step D8: Key Management Institution 3 (Key Management Institution 4)
Random number data R ₁ from the pseudo-session encryption key K ^* is (R
₂ ) Random number data erasing means 36 (46) for erasing
System secret key Rs using, Ss ₁ K ₁ from (Ss ₂₎ and the random number data R ₁ and (R ₂₎ and the date and time information ^{D '= (K * · Rs} · D) Ss1 / R 1 = (Kab · Rs _{^{· D) Ss1 · (R 1}} PsSs1 / R 1) · R 2 PsSs1 (modn) [K 2 '= (K * · Rs · D) Ss2 / R 2 = (Kab · Rs · D) Ss2 · R 1 PsSs2 _{^{· (R 2 PsSs2 / R 2}} ) calculating a (modn)]. Prepare for random number data erasure.

Step D9: The key management institution device 3 (key management institution device 4) sends K ₁ ′ (K ₂ ′) to the enforcement institution device 5. Step D10: The enforcement agency device 5 uses the session encryption key reconstructing means 52 to reconstruct the session encryption key Kd from K ₁ ′ (K ₂ ′) and the system public keys Ps, g ^{1 / Rs} . _{Kd '= K 1' · K} 2 '= (Kab · Rs · D) Ss1 + Ss2 · (R 1 Ps (Ss1 + Ss2) / R 1) · (R 2 Ps (Ss1 + Ss2) / R 2) = (Kab · Rs · D) ^Ss · (R ₁ ^PsSs / R ₁ ) · (R ₂ ^PsSs / R ₂ ) = (Kab · Rs · D) ^Ss (modn) Kd = ((g ^{1 / Rs} ) ^{Kd ′} ) ^Ps = (g ^{1 / Rs} ) ^KabRsD = g ^KabD (mod n) Step D11: The enforcement authority apparatus 5 uses the session encryption key Kd in the analysis means 53 to ^{extract the} session key KS = f ⁻¹ (f (KS) from the additional data LEAF using the session encryption key Kd. , Kd), K
d).

Step D12: The enforcement authority uses the session key KS in the common key encryption means 54 to store
Decrypt the ciphertext between data A and B stored in 0. Incidentally, if the user who is the target of the permit is B and the communication partner at this time is A, step D4 is simply replaced as follows. Step D4 ^* : The key management institution device 3 (key management institution device 4) sends the system public key Ps, the divided user secret information Sb ₁ (Sb ₂ ) of the user B, and the user public information P of the user A
a and the random number data R ₁ (R ₂ ), the pseudo master key generation means 35 (45) uses the pseudo master key K ₁ = Pa ^Sb1 · R ₁ ^Ps (modn), (K ₂ = Pa ^Sb2 ·
R ₂ ^Ps (modn)) is calculated.

Such a process is performed as follows: Kab = Pb ^Sa = Pa ^Sb =
This is possible because g ^SaSb (mod n) always holds.
Therefore, it indicates that the same method can be used regardless of whether the user who is the target of the permit is the sender or the receiver, and the key management institution devices 3 and 4 use The user secret information is that of the user who is the target of the permit, and only the user public information is used for the communication partner user. Therefore, the user secret information of the user who is not the target of the permit is not used.

In the above description, this method has been described on the assumption that there are two key management institutions. However, by changing the number of divisions of the user secret information and the system secret key, one or more key management units can be used. Can be constructed as a system in which For example, if alone, the key management institution apparatus owns all of the user secret information and the system secret key.
Up to D7 can be omitted, and Kd '
= (Kab · Rs · D) ^Ss . If there are k (k > 2) key management institutions, Ss = Σ
_The system secret key and the user secret information may be divided and owned so as to satisfy _{j = 1} ^k Ssj, Si = Σ _{j = 1} ^k Sij. In this case, at step D6, K ^* = Π _{j = 1} ^k K _j
(modn), in step _{D10 Kd '= 1 = Π j} k K j' (m
odn) can be realized by exactly the same processing.

The algorithm to be used is publicly disclosed.
Both the key encryption method and the common key encryption method use the algorithms described above.
It is not limited to islam. In addition, additional data LE
In the AF, in addition to the data described above, the sender name, receiver name, etc.
Various additional information may be connected. Also the smell mentioned above
Public information Pi and divided user secret information S
i₁, Si_TwoTo the key management institution devices 3 and 4₁, Pi and
Si_TwoAnd registered, but the cells unique to users A and B
The key key Kab₁, Kab_TwoAs a key management body
The information may be registered in the devices 3 and 4. That is, between users A and B
It is assumed that a unique master key Kab is set. This and
Kab = Kab₁・ Kab_TwoKab
Kab₁, Kab_TwoAnd the key management institution device 3 (key management machine
Seki device 4) is Kab₁(Kab_Two) Are interpolated. S
K at Step D4₁= Kab₁・ R₁ ^Ps(mod n), (K_Two= K
ab_Two・ R_Two ^Ps(mod n)) and calculate K in step D6.^*= K₁・ K_Two= (Kab₁・ Kab_Two) ・ R₁ ^Ps・ R_Two ^Ps ＝ Kab ・ R₁ ^Ps・ R_Two ^Ps(mod n) is calculated, and the following processing is the same. Also, k (k>
2) If there are key management agencies, Kab = Π_{j = 1} ^kKab
split the master key to satisfy j
No.

[0044]

As described above, according to the present invention,
The following effects can be obtained. (1) The system can be realized using only a public algorithm. (2) When decryption of a ciphertext or duplication of a session key is performed based on a law or a contract, etc., the ciphertext can be deciphered or the session key can be reliably reproduced only within a prescribed range. (3) Even if an attempt is made to decipher the ciphertext or duplicate the session key unduly, the ciphertext cannot be decrypted and the session key cannot be duplicated. (4) A person who does not have authority according to law or contract cannot decrypt ciphertexts or duplicate session keys at all.

[Brief description of the drawings]

FIG. 1 is a functional configuration diagram of a key management system according to an embodiment of the present invention.

FIG. 2 is a flowchart showing an operation procedure when a system is constructed in the embodiment of the present invention.

FIG. 3 is a flowchart showing an operation procedure when a user subscribes to the system according to the embodiment of the present invention.

FIG. 4 is a flowchart showing an operation procedure at the time of encrypted communication in the embodiment of the present invention.

FIG. 5 is a flowchart showing an operation procedure when executing ciphertext decryption or session key duplication in the embodiment of the present invention.

FIG. 6 is a diagram showing an operation outline in the clipper chip.

Claims (11)

[Claims] 1. A key management method for managing a session key used for encryption communication of a message in an encryption communication system, wherein a key management institution device or a key generation institution device sets a system public key and a system secret key at the time of system construction. In addition, when a user joins the system, the user's device (hereinafter referred to as a user device) or the key generation institution device or the key management institution device generates user public information and user secret information, or generates a master key for identifying a communication party. After the generation, the process of publishing the system public key and the user public information on the system and registering and managing the system secret key and the user secret information or the master key in one or a plurality of key management institutions; and The originating user equipment has a master key to identify the communicating party, date and time information, etc. A session encryption key is generated using data including data indicating a temporal element, and additional data is generated by encrypting data including the session key using the session encryption key. Transmitting to the receiving-side user device, the receiving-side user device generates a session encryption key using data including a master key specifying a communication party and data indicating a time element such as date and time information, Decrypting the received additional data using the session encryption key to obtain a session key. 2. When an enforcement agency device decrypts a ciphertext or duplicates a session key, the key management agency device uses a master key identifying a communication party, data indicating time elements such as date and time information, and a key management agency. A pseudo master key is generated using the data including the random number data generated by the device and provided to the enforcement agency device. After the enforcement agency device generates the pseudo session encryption key using the pseudo master key, the key management agency The key management authority device prepares to erase the random number data from the pseudo session encryption key and returns it to the enforcement authority device. After the enforcement device reconfigures the session encryption key, the key management authority device reconstructs the session encryption key. 2. The key management method according to claim 1, further comprising the step of: obtaining a session key by decrypting the additional data using the key. 3. The key management according to claim 1, wherein a master key for identifying a communication party is generated from one user secret information of the communication party and user public information of a communication partner of 0. Method. 4. In the process of registering and managing a system secret key and user secret information or a master key in a plurality of key management authority devices, the secret information is divided and each key management authority device divides the divided secret information. 4. The key management method according to claim 1, wherein the key is managed. 5. The division of the system secret key Ss and the user secret information Si is performed as follows: Ss = Σ _{j = 1} ^k Ssj,
Si = Σ _{j = 1} ^k The number of key management organization devices is divided into k (k is an integer of 2 or more) so as to satisfy Sij, the system secret key Ssj divided into the j-th key management organization device, and the divided user 5. The key management method according to claim 4, wherein the secret information Sij is managed. 6. The division of the system secret key Ss and the master key Kab specifying the users A and B is performed by Ss
= Σ _{j = 1} ^k Ssj, Kab = Π _{j = 1} ^k Kabj so that the number of key management institution devices is divided into k (k is an integer of 2 or more),
5. The key management method according to claim 4, wherein the j-th key management institution manages the divided system secret key Ssj and the divided master key Kabj. 7. A method for generating a session encryption key by encrypting a system public key with data including a master key specifying a communication party and data indicating a time element such as date and time information. The key management method according to any one of claims 1 to 4, wherein the key management unit generates a key. 8. When generating additional data, generating additional data by encrypting data including a session key by a common key encryption method using a session encryption key, and obtaining the session key. 8. The key management according to claim 1, wherein a session key is obtained by decrypting the additional data by a common key encryption method using the session encryption key. Method. 9. The transmitting user equipment adds a checksum indicating the validity of the additional data to the additional data, and verifies whether the additional data received by the receiving user equipment is correct information using the checksum. The key management method according to any one of claims 1 to 6, wherein: 10. When erasing random number data from a pseudo session encryption key, erasing the random number data from the pseudo session encryption key by using a public key encryption method using a system secret key and a system public key. The key management method according to any one of claims 1 to 5, and 7 to 9. 11. A key management system for managing a session key used for encrypting a message in a cryptographic communication system, wherein the user device includes: a session key generating means for setting a session key; and a master key for specifying a communication party. Master key generation means for generating, date and time management means for managing data indicating time elements such as date and time information, session encryption key generation means for generating a session encryption key, and additional data generation means for generating additional data And a session key obtaining means for obtaining a session key from the additional data; and an encryption means for performing cryptographic communication. The key management authority device includes a system public key and a system secret key, a user public information and a user secret. An information generating means for generating information or a master key, and a system for registering and managing a system secret key. Secret key management database, a user secret information management database for registering and managing user secret information or a master key, random number data generating means for generating random number data, and a pseudo master key for generating a pseudo master key to be provided to an enforcement agency device A master key generating unit; and a random number data erasing unit for erasing random number data from the pseudo session encryption key. The execution unit includes a storage unit for storing cipher text and additional data, and a pseudo session encryption. A key management system comprising: a pseudo session encryption key generation unit that generates a key; a session encryption key reconfiguration unit that reconfigures a session encryption key; and an analysis unit that obtains a session key.