Cryptographic communication system, key exchange node, application execution environment, control method, and program

Abstract

To provide an encryption communication system capable of notifying a user of a storage amount of encryption keys.SOLUTION: An encryption communication system includes an application execution environment, an encryption / decryption execution environment, and a key exchange node. The encryption / decryption execution environment encrypts transmission data and decrypts encrypted reception data while consuming the encryption key. The key exchange node generates an encryption key and shares the encryption key with a communication partner. The key exchange node controls whether or not to generate a cryptographic key based on the stored amount of cryptographic keys. The application execution environment includes a stored key amount notification function unit and a band control function unit. The stored key amount notification function unit notifies the stored amount of cryptographic keys. The band control function part receives the notification and automatically executes control of a communication band different for each communication content on the basis of the priority set for each communication content. The band control function unit automatically changes the control content of the communication band according to the notification content without a user's operation.SELECTED DRAWING: Figure 9

Description

[Technical Field]

[0001] The present invention relates to an encrypted communication system, a key exchange node, an application execution environment, a control method, and a program. [Background technology]

[0002] Recently, various cryptographic communication systems have been used to protect the confidentiality of data transmitted and received over a network. One of these systems is a cryptographic communication system that uses a key exchange node that has the function of generating an encryption key used to encrypt data. The key exchange node shares the generated encryption key with the key exchange node of the communication partner and stores the encryption key shared with the key exchange node of the communication partner. The key exchange node transmits the encryption key that it has generated to the key exchange node of the communication partner, and may also receive the encryption key generated by the key exchange node of the communication partner from the key exchange node of the communication partner (key exchange).

[0003] The encryption communication device used in the above-mentioned encryption communication system encrypts transmission data of various application programs using an encryption key stored in a key exchange node. The encryption communication device also uses the encryption key stored in the key exchange node to decrypt received encrypted data.

[0004] There are several types of encryption methods used in encryption communication devices. However, when using a method such as a one-time pad (OTP) method, which uses random numbers of the same length as the communication volume and does not reuse random numbers once used, if the consumption of encryption keys continues to exceed the supply, there is a possibility that encryption keys will be depleted. In other words, although an encryption communication system using a key exchange node has the function of generating encryption keys, it can also be considered a system with a finite number of encryption keys under certain circumstances. Quantum cryptography, which has recently attracted attention, also uses encryption keys generated by quantum key distribution, so if the consumption of encryption keys exceeds the supply, encryption keys will become finite. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Laid-Open No. 2014-241464 [Non-patent literature]

[0006] [Non-Patent Document 1] ITU-T Y.3000 Overview on networkssupporting quantum key distribution Summary of the Invention [Problem to be solved by the invention]

[0007] It is desirable for users of cryptographic communication systems with a limited number of cryptographic keys to be able to check the amount of stored cryptographic keys at any time in order to predict when the cryptographic keys will run out, determine how long the current communication can continue, and assign priority to the communication content (source, destination, protocol, etc.). However, until now, no mechanism has been realized for notifying users of the amount of stored cryptographic keys.

[0008] The problem that the present invention aims to solve is to provide a cryptographic communication system, a key exchange node, an application execution environment, a control method, and a program that make it possible to notify a user of the amount of accumulated cryptographic keys, etc. [Means for solving the problem]

[0009] According to an embodiment, the cryptographic communication system includes an application execution environment, an encryption / decryption execution environment, and a key exchange node. The application execution environment runs an application program that transmits and receives data via a network. The encryption / decryption execution environment encrypts data transmitted by the application program and decrypts encrypted data received by the application program while consuming an encryption key for each predetermined processing unit. The key exchange node generates an encryption key, shares the generated encryption key with a communication partner, and stores the encryption key shared with the communication partner. The key exchange node includes a key storage amount monitoring function unit. The key storage amount monitoring function unit monitors the storage amount of encryption keys. The key exchange node controls whether to generate encryption keys based on the storage amount of encryption keys obtained by the key storage amount monitoring function unit. The application execution environment includes a key storage amount notification function unit and a bandwidth control function unit. The key storage amount notification function unit notifies the application program or a user of the application program of the storage amount of encryption keys obtained by the key storage amount monitoring function unit. The bandwidth control function unit receives the notification from the key accumulation amount notification function unit and automatically controls the communication bandwidth differently for each communication content based on the priority set for each communication content. The bandwidth control function unit can automatically change the control content of the communication bandwidth according to the notification content without user operation. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram showing an example of the configuration of an encrypted communication system according to a first embodiment; [Figure 2] FIG. 10 is a diagram showing an example of displaying the accumulated amount of encryption keys in the encryption communication system according to the first embodiment; [Figure 3] FIG. 10 is a diagram showing another example of displaying the amount of stored encryption keys in the encryption communication system according to the first embodiment; [Figure 4] FIG. 10 is a diagram showing a modified example of a method for displaying the accumulated amount of encryption keys in the encryption communication system of the first embodiment. [Figure 5] FIG. 10 is a diagram showing another modified example of the method for displaying the accumulated amount of encryption keys in the encryption communication system of the first embodiment. [Figure 6] 1 is a flowchart showing a procedure for generating an encryption key in the encryption communication system of the first embodiment; [Figure 7] 1 is a flowchart showing an encryption procedure in the encrypted communication system of the first embodiment; [Figure 8] 1 is a flowchart showing a procedure for notifying the accumulated amount of encryption keys in the encryption communication system of the first embodiment; [Figure 9] FIG. 10 is a diagram showing an example of the configuration of an encrypted communication system according to a second embodiment; DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, embodiments will be described with reference to the drawings.

[0012] (First embodiment) First, the first embodiment will be described.

[0013] FIG. 1 is a diagram illustrating an example of the configuration of an encrypted communication system according to the first embodiment.

[0014] The encrypted communication system of this embodiment is made up of an application execution environment 1, an encryption / decryption execution environment 2, and a key exchange node 3.

[0015] The application execution environment 1 is an environment in which an application program 11 that transmits and receives data via a network runs, and is, for example, an information processing device such as a server or a personal computer. Although Fig. 1 shows only one application program 11 in the application execution environment 1, multiple application programs 11 that transmit and receive data via a network may exist in the application execution environment 1.

[0016] The encryption / decryption execution environment 2 encrypts transmission data of the application program 11 running in the application execution environment 1 and decrypts encrypted reception data of the application program 11. The encryption / decryption execution environment 2 may be realized in software by a program, or in hardware by an electronic circuit or the like. If realized in software, the encryption / decryption execution environment 2 may be built on the information processing device on which the application execution environment 1 is built. However, from the viewpoint of preventing leakage of the encryption key, it is preferable that the encryption / decryption execution environment 2 be built on a different information processing device so as to be not only logically separated from the application execution environment 1 but also physically separated. The encryption / decryption execution environment 2 has an encryption function unit 21 and a decryption function unit 22.

[0017] The key exchange node 3 generates an encryption key to be used for encryption performed in the encryption / decryption execution environment 2, shares the generated encryption key with the key exchange node 3 of the communication partner, and stores the encryption key shared with the key exchange node 3 of the communication partner. The key exchange node 3 transmits the encryption key it generated to the key exchange node 3 of the communication partner, and may also receive an encryption key generated by the key exchange node 3 of the communication partner from the key exchange node 3 of the communication partner (key exchange). The key exchange node 3 may also be realized as software by a program or as hardware by an electronic circuit or the like. If realized as software, the key exchange node 3 may be built on an information processing device on which the application execution environment 1 and the encryption / decryption execution environment 2 are built. However, from the viewpoint of preventing leakage of the encryption key, it is preferable that the key exchange node 3 be built on a different information processing device so as to be not only logically separated but also physically separated from at least the application execution environment 1. The key exchange node 3 has a key generation management function unit 31 and a key storage function unit 32.

[0018] First, the basic operation of the encryption system when data is transmitted from one application program 11 to another application program 11 via a network will be described.

[0019] The transmission data output by an application program 11 running in an application execution environment 1 on the sending side (the side surrounded by the dashed rectangle 100) to an application program 11 running in an application execution environment 1 on the receiving side (the side surrounded by the dashed rectangle 200) is transferred to the encryption / decryption execution environment 2 on the sending side, and is encrypted by the encryption function unit 21 of the encryption / decryption execution environment 2.

[0020] The encryption function unit 21 encrypts the transmission data using an encryption key stored in the key storage function unit 32 of the key exchange node 3. The encryption function unit 21 encrypts the transmission data using, for example, a one time pad (OTP) method that uses a random number of the same length as the communication volume and does not reuse a random number once used. In other words, the encryption function unit 21 consumes the encryption key stored in the key storage function unit 32 for each predetermined processing unit.

[0021] The encryption key used for encryption by the encryption function unit 21 is generated by the key generation management function unit 31. The key generation management function unit 31 executes generation of an encryption key when the amount of encryption keys stored in the key storage function unit 32 is not full (100%). The method for generating an encryption key is not limited to a specific method, and various methods can be applied.

[0022] The key storage function unit 32 of the key exchange node 3 also stores the encryption key used for decryption by the decryption function unit 22 of the encryption / decryption execution environment 2. The data decrypted by the decryption function unit 22 is data (received data) sent in an encrypted state from the communication partner. This encryption key is an encryption key generated by the key generation management function unit 31 of the key exchange node 3 of the communication partner. The key generation management function unit 31 stores the encryption keys (encryption key for encryption and encryption key for decryption) shared with the communication partner in the key storage function unit 32.

[0023] The transmission data encrypted by the encryption function unit 21 is transferred to the encryption / decryption execution environment 2 on the receiving side via the network. Note that on the receiving side, this transmission data is treated as received data. The encrypted received data is decrypted by the decryption function unit 22 of the encryption / decryption execution environment 2. The encryption key for decrypting the received data is received by the key generation management function unit 31 from the key generation management function unit 31 of the communication partner and stored in the key storage function unit 32. The decryption function unit 22 decrypts the encrypted received data using the encryption key stored in the key storage function unit 32. The received data decrypted by the decryption function unit 22 is transferred to the application program 11 running in the application execution environment 1 on the receiving side.

[0024] In this way, data transmitted and received between the application program 11 running in the sending application execution environment 1 and the application program 11 running in the receiving application execution environment 1 is encrypted using an encryption key shared between the sending key exchange node 3 and the receiving key exchange node 3 between the sending encryption / decryption execution environment 2 and the receiving encryption / decryption execution environment 2, i.e., on the network, thereby protecting the confidentiality of the data.

[0025] Note that an application program 11 running in the application execution environment 1 may transmit and receive data to and from multiple application programs 11 each running in a different application execution environment 1. Furthermore, multiple application programs 11 running in the application execution environment 1 may transmit and receive data to and from application programs 11 running in different application execution environments 1. Therefore, the encryption / decryption execution environment 2 is not limited to transmitting and receiving data to and from the encryption / decryption execution environments 2 of communication partners on a one-to-one basis, but may also transmit and receive data to and from the encryption / decryption execution environments 2 of communication partners on a one-to-many basis.

[0026] For example, if the amount of data transmitted by one or more application programs 11 running in the application execution environment 1 increases sharply, the amount of encryption keys consumed by the encryption function unit 21 of the encryption / decryption execution environment 2 also increases sharply. If this consumption exceeds the amount of encryption keys generated by the key generation management function unit 31 of the key exchange node 3 and supplied to the key storage function unit 32, the amount of encryption keys stored in the key storage function unit 32 decreases. If the situation in which the consumption of encryption keys exceeds the supply continues for a long period of time, there is a possibility that encryption keys will run out.

[0027] If the depletion of encryption keys can be predicted, the user can determine how long the current communication can continue and can take measures such as prioritizing the communication content (sender, destination, protocol, etc.). For example, a measure can be taken such that the transmission of data such as application program 11 for online conferences, which requires real-time transfer of video and audio of online conferences, is prioritized (sender) over the transmission of data such as application program 11 for e-mail, which can tolerate some delay. For example, a measure can be taken such as stopping application program 11 for e-mail until the online conference is finished.

[0028] Alternatively, to prevent data transmission to a certain communication partner from being halted due to encryption key exhaustion, measures can be taken such as refraining from transmitting data to other communication partners (destination). Furthermore, measures can be taken such as continuing to transmit audio only and halting video transmission in an online conference (protocol).

[0029] In this way, if the depletion of encryption keys can be predicted, the user can select communications that he or she wants to prioritize.

[0030] Therefore, the encrypted communication system of this embodiment is capable of predicting the depletion of encryption keys, and if the depletion of encryption keys is predicted, notifying the user of the accumulated amount of encryption keys in order to set priorities for the allocation of encryption keys for each communication content (source, destination, protocol, etc.). This point will be described in detail below.

[0031] 1, in the encrypted communication system of this embodiment, the key exchange node 3 further includes a key accumulation amount monitoring function unit 51, and the application execution environment 1 further includes a key accumulation amount notification function unit 52 and a key accumulation amount display function unit 53. Note that, although an example is shown here in which the key accumulation amount display function unit 53 is realized as an independent program specialized for display functions that runs in the application execution environment 1, the key accumulation amount display function unit 53 can also be realized as one function unit of the application program 11 that runs in the application execution environment 1 (53-2), or can also be realized as a dedicated display device or the like (53-3).

[0032] The key storage amount monitoring function unit 51 of the key exchange node 3 monitors the storage amount of encryption keys in the key storage function unit 32. The key storage amount monitoring function unit 51 notifies the key storage amount notifying function unit 52 of the application execution environment 1 of the storage amount of encryption keys obtained through monitoring, for example, at regular intervals or when a change in the storage amount is triggered. Alternatively, the key storage amount notifying function unit 52 of the application execution environment 1 may obtain the storage amount of encryption keys from the key storage amount monitoring function unit 51 of the key exchange node 3, for example, at regular intervals. In other words, in the cryptographic communication system of this embodiment, the application execution environment 1 (key storage amount notifying function unit 52) ​​and the key exchange node 3 (key storage amount monitoring function unit 51) cooperate with each other.

[0033] When the key accumulation amount notification function unit 52 of the application execution environment 1 acquires the accumulation amount of encryption keys in the key accumulation function unit 32 from the key accumulation amount monitoring function unit 51 of the key exchange node 3, it notifies the key accumulation amount display function unit 53 of the accumulation amount of encryption keys. Upon receiving the notification, the key accumulation amount display function unit 53 presents the notified accumulation amount of encryption keys to the user via, for example, a display device provided for GUI in the information processing device on which the application execution environment 1 is established. The key accumulation amount display function unit 53 displays the accumulation amount of encryption keys on the display screen of the display device in a display format that is intuitively easy for the user to understand.

[0034] FIG. 2 is a diagram showing an example of the amount of encryption keys stored in the key storage function unit 32 of the key exchange node 3 displayed by the key storage amount display function unit 53. In FIG.

[0035] As shown in FIG. 2, the key storage amount display function unit 53 displays a window 320 for displaying the storage amount of encryption keys on a display screen 300 of a display device provided for GUI in an information processing device in which the application execution environment 1 is established, i.e., on the display screen 300 on which a window 310 of an application program 11 running in the application execution environment 1 is displayed. The key storage amount display function unit 53 displays the storage amount of encryption keys at that time in the window 320 in the form of a graph, such as a vertical bar graph (A), a horizontal bar graph (B), or a circular graph (C). This graph allows the user to understand the usage rate of encryption keys at that time. If the usage rate represented by this graph suddenly drops, the user can predict the depletion of encryption keys and take various measures as described above.

[0036] Furthermore, the key storage amount display function unit 53 is not limited to displaying the storage amount of encryption keys in a graph, but can also display the storage amount of encryption keys in various display formats. Figure 3 shows another example of displaying the storage amount of encryption keys.

[0037] Fig. 3(A) is an example of displaying the usage rate of encryption keys as a numerical value. Fig. 3(B) is an example of displaying the accumulated amount of encryption keys at that time (data amount: Now) and the total amount of encryption keys that can be accumulated by the key accumulation function unit 32 (data amount: Total) side by side as numerical values. Fig. 3(C) is an example of displaying a line graph in which the accumulated amount of encryption keys is plotted at a regular interval. Furthermore, the key accumulation amount display function unit 53 may adopt a display format that combines the bar graph shown in Fig. 2(A) and the line graph shown in Fig. 3(C), for example.

[0038] Figure 4 shows an example of the display of the accumulated amount of cryptographic keys when the key accumulation amount display function unit 53 is implemented as one functional unit of the application program 11 running in the application execution environment 1 (Figure 1: 53-2).

[0039] In this case, the accumulated amount of encryption keys is displayed in a window 310 displayed by an application program 11 having a key accumulated amount display function unit 53 as one of its functional units, for example, in the display form shown in Figures 2 and 3. Figure 4(A) shows an example in which a display area 311 for the accumulated amount of encryption keys is provided at the bottom of the window 310. Figure 4(B) shows an example in which a display area 312 for the accumulated amount of encryption keys is provided at the bottom right of the window 310. Figure 4(C) shows an example in which a display area 312 for the accumulated amount of encryption keys is provided at the right side of the window 310. The user may be able to select from the display areas 311 to 313 as appropriate.

[0040] FIG. 5 is a diagram showing an example of displaying the accumulated amount of encryption keys when the key accumulated amount display function unit 53 is realized as a dedicated display device (53-3 in FIG. 1).

[0041] In this case, the accumulated amount of encryption keys is displayed on the display screen 400 of the key accumulation amount display function unit 53 (53-3), which is realized as a display-only device, for example, located near the display screen 300 on which the window 310 of the application program 11 running in the application execution environment 1 is displayed, in the display form shown in Figures 2 and 3, for example.

[0042] In this way, the key accumulation amount display function unit 53 may be realized as an independent program specialized for display functions that operates in the application execution environment 1, or may be realized as a functional unit of the application program 11 that operates in the application execution environment 1, or may even be realized as a dedicated display device, etc.

[0043] FIG. 6 is a flowchart showing the procedure for generating an encryption key in the encryption communication system of this embodiment.

[0044] The key generation management function unit 31 of the key exchange node 3 determines whether the amount of encryption keys stored in the key storage function unit 32 of the key exchange node 3 is full (100%) (S101). If it is not full (S101: YES), the key generation management function unit 31 executes generation of an encryption key (S102). The encryption key generated by the key generation management function unit 31 is stored in the key storage function unit 32. If it is full (S101: NO), the key generation management function unit 31 skips S102.

[0045] If the encrypted communication system is still in service (S103: YES), the key generation management function unit 31 repeats the process from S101. If the encrypted communication system stops service (S103: NO), the key generation management function unit 31 ends the generation of the encryption key.

[0046] FIG. 7 is a flowchart showing the encryption procedure in the encrypted communication system of this embodiment.

[0047] The encryption function unit 21 of the encryption / decryption execution environment 2 determines whether or not an encryption request has been received (S201). If an encryption request has been received (S201: YES), the encryption function unit 21 determines whether or not the amount of encryption keys stored in the key storage function unit 32 of the key exchange node 3 exceeds a threshold value (X%) (S202). The threshold value is determined based on, for example, a statistical value of the amount of data transmitted over a network.

[0048] If the threshold value is exceeded (S202: YES), the encryption function unit 21 uses the encryption key stored in the key storage function unit 32, that is, consumes the encryption key, to perform the requested encryption (S203).

[0049] On the other hand, if the accumulated amount of encryption keys is equal to or less than the threshold (S202: NO), the encryption functional unit 21 returns an error to the encryption request and skips S203. Also, if an encryption request has not been received (S201: NO), the encryption functional unit 21 skips S202 to S203.

[0050] If the encrypted communication system is still in service (S204: YES), the encryption function unit 21 repeats the process from S201. If the encrypted communication system stops service (S204: NO), the key generation management function unit 31 ends encryption.

[0051] FIG. 8 is a flowchart showing the procedure for notifying the accumulated amount of encryption keys in the encryption communication system of this embodiment.

[0052] Notification of the accumulated amount of cryptographic keys in the cryptographic communication system of this embodiment can be broadly divided into three steps: processing (a1) by the key accumulation amount monitoring function unit 51 of the key exchange node 3, processing (a2) by the key accumulation amount notification function unit 52 of the application execution environment 1, and processing (a3) ​​by the key accumulation amount display function unit 53 of the application execution environment 1.

[0053] First, the key storage amount monitoring function unit 51 of the key exchange node 3 acquires the storage amount of encryption keys in the key storage function unit 32 of the key exchange node 3 (S301). The key storage amount monitoring function unit 51 notifies the acquired storage amount of encryption keys to the key storage amount notification function unit 52 of the application execution environment 1 (S302).

[0054] The key accumulation amount notification function unit 52 receives the accumulated amount of encryption keys from the key accumulation amount monitoring function unit 51 (S303) and notifies the received accumulated amount of encryption keys to the key accumulation amount display function unit 53 of the application execution environment 1 (S304).

[0055] The key accumulation amount display function unit 53 receives the accumulation amount of encryption keys from the key accumulation amount notification function unit 52 (S305), and updates the accumulation amount of encryption keys, which is displayed, for example, as a graph, based on the received accumulation amount of encryption keys (S306).

[0056] If the encrypted communication system is still in service (S307: YES), the processing from S301 is repeated by the key storage amount monitoring function unit 51, the key storage amount notification function unit 52, and the key storage amount display function unit 53. If the encrypted communication system stops service (S307: NO), the notification of the storage amount of encryption keys by the key storage amount monitoring function unit 51, the key storage amount notification function unit 52, and the key storage amount display function unit 53 ends.

[0057] In addition, the exchange of the accumulated amount of encryption keys between the key accumulation amount monitoring function unit 51 and the key accumulation amount notification function unit 52 may be performed by the key accumulation amount notification function unit 52 obtaining the accumulated amount of encryption keys from the key accumulation amount monitoring function unit 51, for example, at regular intervals.

[0058] In this way, the encrypted communication system of this embodiment can notify the user of the accumulated amount of encryption keys.

[0059] (Second embodiment) Next, a second embodiment will be described.

[0060] FIG. 9 is a diagram illustrating an example of the configuration of an encrypted communication system according to the second embodiment.

[0061] In the encrypted communication system of this embodiment, the application execution environment 1 further comprises a bandwidth control function unit 54.

[0062] The key accumulation amount notification function unit 52 of the application execution environment 1 in the cryptographic communication system of this embodiment notifies the bandwidth control function unit 54 as well as the key accumulation amount display function unit 53 of the accumulated amount of cryptographic keys in the key accumulation function unit 32 of the key exchange node 3, which is notified by the key accumulation amount monitoring function unit 51 of the key exchange node 3.

[0063] The bandwidth control function unit 54 is interposed between the application program 11 running in the application execution environment 1 and the encryption function unit 21 of the encryption / decryption execution environment 2, and controls the amount of encryption keys consumed by the application program 11 based on the accumulated amount of encryption keys notified by the key accumulation amount notification function unit 52. Specifically, it limits the amount of transmission data of the application program 11 relayed to the encryption function unit 21. In other words, it controls the communication bandwidth that can be used for the transmission data of the application program 11.

[0064] For example, if it is predicted that the encryption keys will run out within a predetermined time if the amount of stored encryption keys continues to decrease at the current pace, the bandwidth control function unit 54 executes control to take measures such as prioritizing communication contents (sender, destination, protocol, etc.) as described in the first embodiment. For example, the bandwidth control function unit 54 prioritizes the transmission of data such as application program 11 for online conferences that requires real-time transfer, such as video and audio of online conferences, over the transmission of data such as application program 11 for email, which can tolerate some delay.

[0065] The bandwidth control function unit 54 can set the conditions for limiting the communication bandwidth and the content of the limitation by, for example, inputting parameters at startup. Alternatively, a setting file that can be edited by an editor or the like may be prepared.

[0066] In the encrypted communication system of this embodiment, the key storage amount display function unit 53 also displays the storage amount of encryption keys to the user, so when the bandwidth control function unit 54 restricts the communication bandwidth, the user can recognize that the cause is the storage amount of encryption keys.

[0067] In this way, the encrypted communication system of this embodiment is not only capable of notifying the user of the accumulated amount of encryption keys, but also allows the bandwidth control function unit 54, which receives notification of the accumulated amount of encryption keys from the key accumulation amount notification function unit 52, to automatically perform some or all of the various measures that the user took in the first embodiment after being presented with the accumulated amount of encryption keys.

[0068] Although several embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included within the scope and spirit of the invention, and are also included in the scope of the invention and its equivalents as defined in the claims. [Explanation of symbols]

[0069] 1...Application execution environment, 2...Encryption / decryption execution environment, 3...Key exchange node, 11...Application program, 21...Encryption function unit, 22...Decryption function unit, 31...Key generation management function unit, 32...Key storage function unit, 51...Key storage amount monitoring function unit, 52...Key storage amount notification function unit, 53...Key storage amount display function unit, 54...Bandwidth control function unit.

Claims

1. an application execution environment in which an application program that transmits and receives data via a network runs; an encryption / decryption execution environment that encrypts transmission data of the application program and decrypts encrypted reception data of the application program while consuming an encryption key for each predetermined processing unit; a key exchange node that generates the encryption key, shares the generated encryption key with a communication partner, and stores the encryption key shared with the communication partner; Equipped with The key exchange node a key storage amount monitoring function unit that monitors the storage amount of the encryption keys; Controlling whether to generate the encryption key based on the accumulated amount of the encryption key acquired by the key accumulation amount monitoring function unit; The application execution environment includes: a key storage amount notification function unit that notifies the application program or a user of the application program of the storage amount of the encryption keys acquired by the key storage amount monitoring function unit; a bandwidth control function unit that receives a notification from the key accumulation amount notification function unit and automatically controls a communication bandwidth that differs for each communication content based on a priority set for each communication content; Equipped with The bandwidth control function unit is capable of automatically changing the control content of the communication bandwidth in accordance with the notification content without user operation. Cryptographic communication system.

2. 2. The cryptographic communication system according to claim 1, wherein the key storage amount notification function unit displays a usage rate of the storage amount of the cryptographic keys in a graph, or displays a time-varying change in the storage amount of the cryptographic keys in a graph.

3. The encryption / decryption execution environment of claim 1, wherein if the accumulated amount of the encryption key obtained by the key accumulation amount monitoring function unit is below a threshold, the encryption / decryption execution environment does not encrypt the transmission data and notifies the application program of an error.

4. A control method for an encrypted communication system comprising: an application execution environment in which an application program that transmits and receives data via a network runs; an encryption / decryption execution environment that encrypts transmission data of the application program and decrypts encrypted reception data of the application program while consuming an encryption key for each predetermined processing unit; and a key exchange node that generates the encryption key, shares the generated encryption key with a communication partner, and stores the encryption key shared with the communication partner, The key exchange node: monitoring an accumulation of said encryption keys; Controlling whether to generate the encryption key based on the accumulated amount of the encryption key; Equipped with The application execution environment notifying the application program or a user of the application program of the accumulated amount of the encryption keys obtained by the monitoring; receiving the notification from the notifying device, automatically controlling the communication bandwidth different for each communication content based on the priority set for each communication content; Equipped with The control of the communication band may automatically change the control content of the communication band in accordance with the notification content without any operation by the user. Control method.

5. 5. The control method according to claim 4, wherein the notification includes graphing a usage rate of the accumulated amount of the encryption keys or graphing a time transition of the accumulated amount of the encryption keys.

6. 5. The control method according to claim 4, further comprising the step of: when the accumulated amount of the encryption key is equal to or less than a threshold, the encryption / decryption execution environment notifying the application program of an error without encrypting the transmission data.

7. A program for an encrypted communication system comprising: an application execution environment in which an application program that transmits and receives data via a network runs; an encryption / decryption execution environment that encrypts transmission data of the application program and decrypts encrypted reception data of the application program while consuming an encryption key for each predetermined processing unit; and a key exchange node that generates the encryption key, shares the generated encryption key with a communication partner, and stores the encryption key shared with the communication partner, The key exchange node monitoring an accumulation of said encryption keys; Controlling whether to generate the encryption key based on the accumulated amount of the encryption key; Execute In the application execution environment, notifying the application program or a user of the application program of the accumulated amount of the encryption keys obtained by the monitoring; receiving the notification from the notifying device, automatically controlling the communication bandwidth different for each communication content based on the priority set for each communication content; It is a program for executing The control of the communication band may automatically change the control content of the communication band in accordance with the notification content without any operation by the user. program.

8. 8. The program according to claim 7, wherein the notification includes displaying a graph of a usage rate of the accumulated amount of the encryption key, or displaying a graph of a time transition of the accumulated amount of the encryption key.

9. The program according to claim 7, wherein the encryption / decryption execution environment is configured to notify the application program of an error without encrypting the transmission data if the accumulated amount of the encryption key is equal to or less than a threshold.

Images