Communication method, communication terminal, and communication system

Abstract

A communication method for a communication terminal provided with a storage unit that stores a first certificate that has been given in advance, the communication method including: executing first authentication communication with a first device using the first certificate (S10); acquiring a second certificate different from the first certificate through the first authentication communication (S20); executing a second authentication communication with a second device different from the first device using the acquired second certificate in which a first public key and a first signature using a first private key encryption scheme are stored (S30); a second public key and a second signature which adopt a second private key encryption mode different from the first private key encryption mode are stored in the second certificate.

Description

Technical Field

[0001] This disclosure relates to communication methods, communication terminals, and communication systems. Background Technology

[0002] In the past, certificates (digital certificates) have been commonly used when IoT (Internet of Things) devices communicate with other devices. For example, Patent Document 1 discloses a method for issuing (signing / granting) a certificate, which includes a public key (public key) of a quantum-fragile (easily cracked by quantum computing) cryptographic system (such as RSA cryptography) and a public key of a quantum-resistant (post-quantum) cryptographic system.

[0003] Existing technical documents

[0004] Patent documents

[0005] Patent Document 1: Japanese Patent No. 6644894 Summary of the Invention

[0006] The problem that the invention aims to solve

[0007] In recent years, there has been an increase in the use of two certificates when communicating with other devices, particularly in the field of IoT devices. However, there is room for improvement in the technology of using two certificates for communication. Furthermore, Patent Document 1 does not disclose any method for using two certificates for communication.

[0008] Therefore, this disclosure provides a communication method, communication terminal, and communication system that can make further improvements when communicating using two certificates.

[0009] Technical solutions for solving the problem

[0010] One aspect of this disclosure relates to a communication method of a communication terminal having a storage unit storing a first certificate pre-given (assigned). The communication method includes: performing a first authentication communication with a first device using the first certificate; obtaining a second certificate different from the first certificate through the first authentication communication; and performing a second authentication communication with a second device different from the first device using the obtained second certificate. The first certificate stores a first public key and a first signature encrypted with a first private key, and the second certificate stores a second public key and a second signature encrypted with a second private key, different from the encryption method of the first private key.

[0011] One aspect of this disclosure relates to a communication terminal comprising: a storage unit storing a first certificate pre-granted to the communication terminal; a first authentication communication unit using the first certificate to perform a first authentication communication with a first device; an acquisition unit acquiring a second certificate different from the first certificate through the first authentication communication; and a second authentication communication unit using the second certificate acquired by the acquisition unit to perform a second authentication communication with a second device different from the first device, wherein the first certificate stores a first public key and a first signature encrypted using a first private key, and the second certificate stores a second public key and a second signature encrypted using a second private key, different from the first private key encryption method.

[0012] One aspect of this disclosure relates to a communication system comprising: the aforementioned communication terminal; and the first device that, in the event that one of the first private key encryption method and the second private key encryption method is compromised (the key or data is cracked, or the security protection fails), uses the public key and signature of the other private key encryption method of the first private key encryption method and the second private key encryption method to perform the first authentication communication.

[0013] Invention Effects

[0014] According to one aspect of this disclosure, a communication method can be further improved when communicating using two certificates. Attached Figure Description

[0015] Figure 1 This is a block diagram illustrating the functional structure (configuration) of the communication system involved in Implementation Method 1.

[0016] Figure 2 This is a diagram showing the data structure of the device certificate involved in Implementation 1.

[0017] Figure 3 This is a diagram representing the data structure of the issuing authority certificate involved in Implementation Method 1.

[0018] Figure 4 This is a diagram illustrating the data structure of the communication certificate involved in Implementation Method 1.

[0019] Figure 5 This is a flowchart illustrating the operation of the communication system involved in Implementation 1.

[0020] Figure 6 This is a diagram illustrating an example of the one-way authentication protocol involved in Implementation 1.

[0021] Figure 7 This is a diagram illustrating the data structure of the device certificate involved in a variation of Implementation 1.

[0022] Figure 8 This is a diagram illustrating the data structure of the communication certificate involved in a variation of Implementation 1.

[0023] Figure 9 This is a block diagram illustrating the functional structure of the communication system involved in Implementation Method 2.

[0024] Figure 10 This is a diagram illustrating the data structure of the server certificate involved in Implementation Method 2.

[0025] Figure 11 This is a diagram illustrating an example of the two-way authentication protocol involved in Implementation Method 2.

[0026] Figure 12 This is a diagram representing a combination of encryption methods used in the case of a delegated (requested) certificate issuance.

[0027] Figure 13 This is a diagram representing the combination of encryption methods used in the case of delegated communication processing.

[0028] Figure 14 This diagram represents a combination of encryption methods used when entrusting the renewal or reissue (reissue) of certificates. Detailed Implementation

[0029] (Background of this disclosure)

[0030] As described in the "Problem to be Solved by the Invention," there is an increasing use of two types of certificates when IoT devices and other devices communicate with each other. Examples of these two types of certificates include, for instance, a certificate used to verify (e.g., prove) that a device is legitimate, and a certificate used for authentication in everyday communications. Such certificates contain information such as public keys and signatures.

[0031] Currently, RSA cryptography and elliptic curve cryptography (ECC) are widely used as public-key cryptography. Hereinafter, RSA cryptography and elliptic curve cryptography will also be referred to as current cryptography. Elliptic curve cryptography is also known as elliptic cryptography.

[0032] Current cryptography, such as that based on the discrete logarithm problem and prime factorization, is based on these security principles. While current cryptography can be processed quickly, it is highly likely to be broken once quantum computers are realized. In other words, if quantum computers are developed, secure systems using current cryptography may become insecure. Therefore, we envision quantum-resistant cryptography (PQC), such as lattice cryptography, which uses encryption methods that even quantum computers cannot break in polynomial time. PQC cryptography is based on methods such as lattice problems and solving multivariate polynomial problems. While PQC cryptography is superior to current cryptography in terms of security, there is a concern that its processing time may be longer.

[0033] Therefore, since existing cryptography and quantum-resistant cryptography each have their own advantages and disadvantages, it is hoped that they will be used appropriately according to their intended use.

[0034] The inventors of this application have conducted in-depth research on communication methods that can balance security and convenience (efficiency) as a further improvement in the use of two types of certificates, namely, those utilizing existing cryptography and quantum-resistant cryptography, for communication, and have proposed the following communication method.

[0035] Furthermore, the Matter (Smart Home Open Source Connectivity) standard can be cited as an example of a standard that uses two types of certificates for certification. In the case of using two certificates, for example, each device is given a certificate (DAC: Device Attestation Certificate) signed (issued) by either a certification body (certification authority) authorized and operated by the standardization body (Matter-accredited certification body) or an intermediate certification body (Product Attestation Intermediate) operated by the device manufacturer. In principle, the DAC is embedded in the device during manufacturing and is used to confirm compliance with the standard. The DAC corresponds to the device certificate described later.

[0036] Alternatively, when using two types of certificates, for example, during initial network setup, devices are typically assigned a Root CA (Root Certificate Authority) certificate (NOC: NodeOperational Certificate) per user. The NOC is used for authentication during inter-device communication. The NOC corresponds to the communication certificate described later.

[0037] Furthermore, the eighth method disclosed herein relates to a communication method of a communication terminal having a storage unit, wherein the storage unit stores a first certificate pre-given, and the communication method includes: performing a first authentication communication with a first device using the first certificate; obtaining a second certificate different from the first certificate through the first authentication communication; and performing a second authentication communication with a second device different from the first device using the obtained second certificate, wherein the first certificate stores a first public key and a first signature encrypted with a first private key, and the second certificate stores a second public key and a second signature encrypted with a second private key different from the first private key encryption method.

[0038] Therefore, in the authentication processes of the first and second authentication communications, public keys and signatures using different private key encryption methods are employed. For example, one private key encryption method may be more secure than the other, thus improving the security of the communication between the terminals. Furthermore, the processing speed of the other private key encryption method may be faster than that of the first, thereby reducing the authentication time and improving the convenience for the user during authentication. In other words, by appropriately setting the private key encryption method, a balance between security and convenience can be achieved when using two certificates for communication with the communication terminal. Therefore, further improvements can be made to the communication method when using two certificates for communication.

[0039] Alternatively, for example, the communication method involved in the second method may be based on the communication method involved in the first method, and the first certificate may also store a third public key and a third signature encrypted using the second private key.

[0040] Therefore, since the first certificate contains the first public key and the first signature, as well as the third public key and the third signature, a balance between security and convenience can be achieved by using appropriate public keys and signatures in authentication.

[0041] Alternatively, for example, the communication method involved in the third method may be based on the communication method involved in the first or second method, and the second certificate may also store a fourth signature encrypted using the first private key.

[0042] Therefore, by using either the second or fourth signature based on the processing speed of the second device, a balance between security and convenience can be achieved.

[0043] Alternatively, for example, the communication method involved in the fourth method may be based on the communication method involved in any of the first to third methods, wherein the first private key encryption method is an encryption method using quantum-resistant cryptography, and the second private key encryption method is an encryption method using a cryptography different from the quantum-resistant cryptography.

[0044] Therefore, by using quantum-resistant cryptography, even if a quantum computer is realized, the risk of it being cracked is small. Furthermore, using a different cryptographic approach than quantum-resistant cryptography may result in shorter processing times. Thus, a balance between security and convenience can be achieved.

[0045] Alternatively, for example, the communication method involved in the fifth method may be based on the communication method involved in any one of the first to fourth methods, and the validity period of the first certificate may be longer than that of the second certificate.

[0046] Therefore, even in situations such as reissuing a second certificate, a single first certificate can be used. Compared to situations where the first certificate has a short validity period and requires frequent updates, this reduces the hassle of those updates. This results in greater convenience.

[0047] Furthermore, the sixth aspect of this disclosure relates to a communication terminal comprising: a storage unit storing a first certificate pre-granted to the communication terminal; a first authentication communication unit using the first certificate to perform a first authentication communication with a first device; an acquisition unit acquiring a second certificate different from the first certificate through the first authentication communication; and a second authentication communication unit using the second certificate acquired by the acquisition unit to perform a second authentication communication with a second device different from the first device, wherein the first certificate stores a first public key and a first signature encrypted using a first private key, and the second certificate stores a second public key and a second signature encrypted using a second private key encryption method different from the first private key encryption method.

[0048] Therefore, it achieves the same effect as the communication methods described above.

[0049] Alternatively, for example, the communication terminal involved in the seventh method may also include, based on the communication terminal involved in the sixth method, a third public key and a third signature encrypted using the second private key in the first certificate.

[0050] Therefore, since the first certificate contains the first public key and the first signature, as well as the third public key and the third signature, a balance between security and convenience can be achieved by using appropriate public keys and signatures in authentication.

[0051] In addition, the communication system involved in the eighth method of this disclosure includes: a communication terminal of the sixth or seventh method; and the first device that, in the event that one of the first private key encryption method and the second private key encryption method is compromised, uses the public key and signature of the other private key encryption method of the first private key encryption method and the second private key encryption method to perform the first authentication communication.

[0052] Therefore, using an uncontaminated private key for encryption results in higher security.

[0053] Alternatively, for example, the communication system involved in the ninth method, based on the communication system involved in the eighth method, may also involve the first device switching the public key and signature used for the first authentication communication from the third public key and the third signature to the first public key and the first signature if the second private key encryption method is compromised during the first authentication communication using the third public key and the third signature. The second authentication communication unit uses the second public key and the second signature as the public key and signature used for the second authentication communication before and after the second private key encryption method is compromised.

[0054] Therefore, if the private key encryption method used is compromised, it can be switched to an uncompromised private key encryption method, thus further improving security.

[0055] Furthermore, these overall or specific technical solutions can be implemented either through systems, methods, integrated circuits, computer programs, or non-transitory recording media such as computer-readable CD-ROMs, or through any combination of systems, methods, integrated circuits, computer programs, or recording media. The program can be pre-stored on the recording medium or supplied to the recording medium via wide area communication networks, including the Internet.

[0056] Hereinafter, the implementation methods will be described in detail with reference to the accompanying drawings.

[0057] Furthermore, the embodiments described below are general or specific examples. The numerical values, shapes, constituent elements, arrangement positions of constituent elements, connection methods, steps, and order of steps shown in the following embodiments are examples and are not intended to limit this disclosure. Additionally, constituent elements in the following embodiments that are not described in the independent claims are described as arbitrary constituent elements.

[0058] Furthermore, these figures are schematic diagrams and not necessarily strictly representational. Therefore, for example, the scale may not be consistent across different figures. Additionally, substantially identical components are labeled with the same reference numerals across different figures, and repetitive descriptions are omitted or simplified.

[0059] Furthermore, in this specification, numerical values ​​and numerical ranges are not expressions that merely represent a strict meaning, but rather expressions that imply substantially equivalent ranges, such as those that also include a difference of approximately a few percent (or about 10%).

[0060] In addition, unless otherwise stated, in this specification, ordinal numbers such as "first" and "second" do not imply the quantity or order of constituent elements, but are used to avoid confusion of constituent elements of the same kind and to distinguish them.

[0061] (Implementation Method 1)

[0062] The following is for reference Figures 1-6 The communication system involved in this embodiment will be described.

[0063] [1-1. The Composition of a Communication System]

[0064] First, refer to Figures 1-4 The configuration of the communication system involved in this embodiment will be described. Figure 1 This is a block diagram illustrating the functional structure of the communication system 1 according to this embodiment. Figure 1 The diagrams illustrating components such as the communication circuit (communication module) are omitted. Furthermore, the following section explains an example of using elliptic curve cryptography (ECC) as the current cryptographic method.

[0065] like Figure 1 As shown, the communication system 1 includes a device certificate issuing authority 10, a communication terminal 20, a communication certificate issuing authority 30, and a server device 40.

[0066] The device certificate issuing authority 10 issues a certificate, i.e., a device certificate, to verify (e.g., prove) that the communication terminal 20 is a legitimate device. The device certificate issuing authority 10 is an organization located outside the manufacturer of the communication terminal 20, and distributes device certificates to that manufacturer. The information processing device (hereinafter also referred to as device certificate issuing authority 10) of the device certificate issuing authority 10 includes a device key pair generation unit 11, a first storage unit 12, a device certificate signing unit 13, and a second storage unit 14. The device certificate issuing authority 10 (information processing device) includes a CPU (Central Processing Unit) and memory, etc., and executes programs stored in the memory through the CPU to realize the various functions of the device certificate issuing authority 10. Furthermore, the device certificate issuing authority 10 is a different organization (different device) from the communication certificate issuing authority 30.

[0067] The device key pair generation unit 11 generates a key pair for communication between the communication terminal 20 and the communication certificate issuing authority 30. In this embodiment, the device key pair generation unit 11 generates a PQC private key and a PQC public key that is paired with the PQC private key.

[0068] The first storage unit 12 is a storage device that stores the device certificate authority private key (hereinafter also referred to as the first private key) used by the device certificate authority 10 when signing (digital signing). The first storage unit 12 is implemented by a hard disk, semiconductor memory, etc., but is not limited to these. The first storage unit 12 is an example of a storage unit.

[0069] The device certificate signing unit 13 uses the private key possessed by the device certificate issuing authority 10 to sign the public key (in this case, the PQC public key) that is paired with the private key. The device certificate signing unit 13 then signs the device certificate (see the next paragraph). Figure 2 The header data of the PQC public key contained in the PQC public key is hashed, and a signature is added to the hash value using a private key (e.g., using RSA cryptography or elliptic cryptography, etc.) to generate a signature value.

[0070] Figure 2 This is a diagram illustrating the data structure of the device certificate involved in this embodiment. The device certificate is a digital certificate, and is an example of the first type of certificate.

[0071] like Figure 2 As shown, the device certificate includes a header, certificate serial number, signer information, validity period, PQC public key, and PQC signature.

[0072] For the header, save header information such as the format and version of the device certificate.

[0073] For the certificate serial number, save the number used to identify the device certificate.

[0074] The signer information stores information about the organization that signed the device certificate, that is, the organization that issued the device certificate. For example, the signer information may include information about the certification authority that issued the device certificate.

[0075] The validity period indicates the duration during which the device certificate can be effectively used. The validity period of the device certificate is longer than that of the communication certificate, which will be described later. The validity period can also be set, for example, based on the product lifespan envisioned in the communication terminal 20. Alternatively, for example, no validity period may be set. Not setting a validity period also includes cases where the validity period is longer than that of the communication certificate.

[0076] The PQC public key is stored in the device key pair generation unit 11. The PQC public key is an example of a first public key using a first private key encryption method (here, an encryption method using quantum-resistant cryptography). Furthermore, this first private key encryption method requires a longer processing time in the processing device (e.g., communication terminal 20 or server device 40) compared to the second private key encryption method using existing cryptography, which will be described later.

[0077] For PQC signatures, the signature (signature value) generated by the device certificate signing unit 13 is stored. PQC signature is an example of the first signature.

[0078] Regarding this device certificate, a different certificate is assigned to each communication terminal 20 during manufacturing. The assigned device certificate is stored in the third storage unit 21 of the communication terminal 20. That is, the device certificate is stored in the third storage unit 21 when the communication terminal 20 leaves the factory. In addition, it can be said that the device certificate is stored in the third storage unit 21 at the time when the user purchases the communication terminal 20, and at the time when the user begins to use the communication terminal 20.

[0079] The device certificate is used to verify that the communication terminal 20 was correctly manufactured during the initial registration of the communication terminal 20 after the user purchases it. In other words, the device certificate is not used for daily communication between the communication terminal 20 and the server device 40. Furthermore, if the device certificate is invalidated (expired), the communication terminal 20 will become unusable; therefore, invalidating the device certificate is generally not considered desirable. For example, in the communication certificate issuing authority 30, it is prohibited to render the device certificate unusable during the authentication of the communication terminal 20. Additionally, the device certificate is set to be unreissueable. For example, in the device certificate issuing authority 10, the reissue of the device certificate is prohibited.

[0080] After the device certificate issuing authority 10 signs the device certificate, the information is stored together with the key pair in the communication terminal 20.

[0081] Refer again Figure 1 The second storage unit 14 is a storage device that stores a device certificate issuing authority certificate containing a public key that is paired with the first private key held by the device certificate issuing authority 10. The second storage unit 14 is implemented using a hard disk, semiconductor memory, etc., but is not limited to these.

[0082] Figure 3 This is a diagram illustrating the data structure of the issuing authority certificate involved in this embodiment. There are device certificate issuing authority certificates and communication certificate issuing authority certificates, but they can all be... Figure 3 The data structure shown.

[0083] like Figure 3 As shown, the issuing authority certificate includes a header, certificate serial number, signer information, validity period, ECC public key, PQC public key, ECC signature, and PQC signature.

[0084] For the header, save header information such as the format and version of the issuing institution's certificate.

[0085] For certificate serial numbers, save the number used to identify the issuing authority's certificate.

[0086] The signer information stores information about the organization that signed the issuing authority certificate, that is, the organization that issued the issuing authority certificate. For example, the signer information may include information about the certification authority that issued the issuing authority certificate.

[0087] The validity period indicates the period during which a certificate issued by an authority can be used effectively.

[0088] For the ECC public key, save the generated ECC public key.

[0089] For the PQC public key, save the generated PQC public key.

[0090] For ECC signatures, store the signature (signature value) generated using the ECC public key.

[0091] For PQC signatures, store the signature (signature value) generated using the PQC public key.

[0092] These issuing authority certificates are used for the first authentication communication between the communication terminal 20 and the communication certificate issuing authority 30, and for the second authentication communication between the communication terminal 20 and the server device 40. Specifically, the device certificate issuing authority certificate is used in the first authentication communication, and the communication certificate issuing authority certificate is used in the second authentication communication.

[0093] Refer again Figure 1 The communication terminal 20 has communication functions and can be a home appliance (so-called IoT home appliance) that can connect to the Internet, or it can be an audio-visual (AV) device, white goods, etc. The communication terminal 20 has a third storage unit 21, a certificate issuance delegation unit 22, a fourth storage unit 23, and a communication processing delegation unit 24. The communication terminal 20 has a CPU and memory, etc., and the CPU executes the programs stored in the memory to realize the various functions of the communication terminal 20.

[0094] The third storage unit 21 is a storage device that stores a device certificate and a private key pre-assigned (e.g., during manufacturing) to the communication terminal 20. This private key is a pair of private keys contained in the device certificate. The third storage unit 21 may be implemented using a hard disk, semiconductor memory, or the like, but is not limited to these.

[0095] Furthermore, the private key can also be stored in a secure storage area within the third storage unit 21. This secure storage area is, for example, the storage area built into the integrated circuit (IC) of the communication terminal 20, and is connected to a secure zone with a mechanism to prevent unauthorized access from the outside. The secure zone is a computational processing unit with low risk of hacking and high reliability. Moreover, the private key is not limited to being stored in a secure storage area; it can also be embedded in the IC using hard-wired logic.

[0096] The Certificate Issuance Commissioning Department 22 performs processing related to the issuance of communication certificates. The Certificate Issuance Commissioning Department 22 uses equipment certificates to perform authentication communication (first authentication communication) with the equipment (first equipment) possessed by the Communication Certificate Issuing Authority 30. The Certificate Issuance Commissioning Department 22 is an example of a first authentication communication department.

[0097] The fourth storage unit 23 is a storage device for storing the communication certificate and private key used when the communication terminal 20 communicates with the server device 40. At the time the user purchases the communication terminal 20, the fourth storage unit 23 does not store the communication certificate and private key. After the first authentication communication is completed, the communication certificate and private key are issued from the communication certificate issuing authority 30. The fourth storage unit 23 is implemented using a hard disk, semiconductor memory, etc., but is not limited to these. The fourth storage unit 23 functions as an acquisition unit for obtaining (e.g., receiving) the communication certificate from the communication certificate issuing authority 30 through the first authentication communication.

[0098] Figure 4 This is a diagram illustrating the data structure of the communication certificate involved in this embodiment. The communication certificate is a digital certificate, an example of a second certificate.

[0099] like Figure 4 As shown, the communication certificate includes a header, certificate serial number, signer information, validity period, ECC public key, and ECC signature.

[0100] The header stores header information such as the format and version of the communication certificate.

[0101] For the certificate serial number, save the number used to identify the communication certificate.

[0102] The signer information stores information about the authority that signed the communication certificate, that is, the authority that issued the communication certificate. For example, the signer information may include information about the device (e.g., an application) that issued the communication certificate.

[0103] The validity period indicates the duration during which a communication certificate can be effectively used. The validity period of a communication certificate is shorter than that of a device certificate. The validity period is set, for example, to a period shorter than the product lifespan envisioned in communication terminal 20; for example, it can be set in units of days, months, or years.

[0104] The ECC public key is stored in the device key pair generation unit 32. The ECC public key is an example of a second public key that uses a second private key encryption method (here, an elliptic cryptography encryption method, an example of a conventional cryptography) that employs a different encryption method than quantum-resistant cryptography. Furthermore, this second private key encryption method has a shorter processing time compared to the first private key encryption method described above when processed in a processing device (e.g., communication terminal 20 or server device 40).

[0105] For ECC signatures, the signature (signature value) generated by the communication certificate signing section 33 is stored. ECC signatures are an example of second signatures.

[0106] This communication certificate is granted to the communication terminal 20 after the device certificate has been verified as a legitimate device. The granted communication certificate is stored in the fourth storage unit 23 of the communication terminal 20. For example, the communication certificate is stored in the fourth storage unit 23 during device registration. In other words, at the time the user purchases the communication terminal 20 (before it is connected to the internet), the fourth storage unit 23 does not contain the communication certificate.

[0107] Furthermore, communication certificates are commonly used certificates, and the private key associated with them is at higher risk of leakage compared to the private key associated with device certificates. Therefore, communication certificates are configured to be invalidated and reissued as needed (e.g., in case of leakage). Additionally, the second private key encryption method used in the communication certificate carries the risk that the private key can be computed using a quantum computer; in this case, invalidation and reissue are also necessary. Invalidating a communication certificate means preventing the server device 40 from using it to authenticate the communication terminal 20. Reissuing a communication certificate means that the communication certificate issuing authority 30 reissues the communication certificate used for communication between the communication terminal 20 and the server device 40.

[0108] Refer again Figure 1 The communication processing delegation unit 24 uses a communication certificate obtained and stored by the fourth storage unit 23 from the communication certificate issuing authority 30 to perform authentication communication (second authentication communication) with a server device 40 (an example of a second device) that is different from the communication certificate issuing authority 30. The communication processing delegation unit 24 is an example of a second authentication communication unit.

[0109] The communication certificate issuing authority 30 issues communication certificates used by the communication terminal 20 and the server equipment 40 during daily communication. The information processing device (hereinafter also referred to as the communication certificate issuing authority 30) of the communication certificate issuing authority 30 includes a device authentication unit 31, a device key pair generation unit 32, a communication certificate signing unit 33, a fifth storage unit 34, and a sixth storage unit 35. The communication certificate issuing authority 30 (information processing device) includes a CPU and a memory, and executes programs stored in the memory through the CPU to realize the various functions of the communication certificate issuing authority 30.

[0110] For example, the communication certificate issuing authority 30 can be implemented by a dedicated information processing device, or it can be implemented by the operation (running) of an application installed on an information terminal such as a smartphone owned by a user who purchased the communication terminal 20. Furthermore, the communication certificate issuing authority 30 is a different entity (different device) from the device certificate issuing authority 10.

[0111] The device authentication unit 31 authenticates whether the communication terminal 20 is a legitimate device based on the device certificate obtained from the communication terminal 20 and the device certificate issuing authority certificate obtained from the device certificate issuing authority 10. The authentication method performed by the device authentication unit 31 is not particularly limited, and any existing authentication method can be used. Furthermore, the device authentication unit 31 can perform authentication of the communication terminal 20 through either one-way authentication or two-way authentication.

[0112] The device key pair generation unit 32 generates a key pair for communication between the communication terminal 20 and the server device 40. In this embodiment, the device key pair generation unit 32 generates an ECC private key and an ECC public key that is paired with the ECC private key.

[0113] The communication certificate signing unit 33 uses the private key possessed by the communication certificate issuing authority 30 to sign the public key (here, the ECC public key). The communication certificate signing unit 33 hashes the header data of the communication certificate containing the ECC public key, and signs the hash value using the private key (e.g., using RSA cryptography or elliptic cryptography, etc.) (generating a signature value).

[0114] The fifth storage unit 34 is a storage device that stores the private key of the communication certificate issuing authority (hereinafter also referred to as the second private key) used when signing as a private key by the communication certificate issuing authority 30. The fifth storage unit 34 is implemented by a hard disk, semiconductor memory, etc., but is not limited to these.

[0115] The sixth storage unit 35 is a storage device that stores a Certificate Authority certificate containing a public key paired with the private key held by the Certificate Authority 30. The sixth storage unit 35 may be implemented using a hard disk, semiconductor memory, etc., but is not limited to these. The data structure of the Certificate Authority certificate may also be, for example, related to... Figure 3 The data structure of the issuing institution certificates shown is the same, so the explanation is omitted.

[0116] Server device 40 is a device that communicates with communication terminal 20 using a communication certificate. Server device 40 has a communication authentication unit 41. Server device 40 has a CPU and memory, etc., and the CPU executes programs stored in the memory to realize the various functions of server device 40.

[0117] The communication authentication unit 41 performs authentication during communication with the communication terminal 20 based on the communication certificate obtained from the communication terminal 20 and the communication certificate issuing authority certificate obtained from the communication certificate issuing authority 30. The authentication method performed by the communication authentication unit 41 is not particularly limited, and any existing authentication method can be used. Furthermore, the communication authentication unit 41 can perform authentication during communication with the communication terminal 20 through either one-way authentication or two-way authentication.

[0118] [1-2. Operation of the Communication System]

[0119] Next, refer to Figure 5 and Figure 6 The operation of the communication system 1 configured as described above will be explained. Figure 5 This is a flowchart illustrating the operation (communication method) of the communication system 1 according to this embodiment. Figure 5 This indicates the actions of the communication terminal 20 after purchase by the user. Furthermore, a third storage unit 21 stores the device certificate and private key.

[0120] like Figure 5 As shown, the certificate issuance delegation unit 22 of the communication terminal 20 uses the device certificate to perform a first authentication communication (S10) with the communication certificate issuing authority 30. The first authentication communication is used to perform authentication for the communication certificate issuing authority 30 to issue a communication certificate. In the first authentication communication, the device certificate is sent from the communication terminal 20 to the communication certificate issuing authority 30.

[0121] In the communication certificate issuing authority 30, the obtained device certificate is used to authenticate whether the communication terminal 20 is a legitimate device. If the communication terminal 20 is authenticated as a legitimate device, the communication certificate issuing authority 30 issues a communication certificate and a private key (the private key in the key pair generated by the device key pair generation unit 32) to the communication terminal 20.

[0122] Next, the communication terminal 20 obtains the issued communication certificate and private key from the communication certificate issuing authority 30 (S20). The obtained communication certificate and private key are stored in the fourth storage unit 23. The fourth storage unit 23 functions as the acquisition unit for obtaining the communication certificate and private key.

[0123] Steps S10 and S20 are executed, for example, when the user connects the communication terminal 20 to the network for the first time after purchasing it. For example, steps S10 and S20 are executed during the network connection setup process.

[0124] Next, when communicating with the server device 40, the communication processing delegation unit 24 of the communication terminal 20 uses the communication certificate to perform a second authentication communication with the server device 40 (S30). This second authentication communication is used to authenticate the communication terminal 20's communication with the server device 40. In this second authentication communication, the communication certificate is sent from the communication terminal 20 to the server device 40. However, the device certificate is not sent in this second authentication communication.

[0125] As described above, the device certificate is used in step S10 to perform authentication using the device certificate in the device authentication unit 31. That is, authentication for the PQC signature is performed. This authentication requires more processing time than ECC signature verification, but since it is only used during device registration and other situations where response speed is not critical, processing time is not a significant issue. On the other hand, because quantum-resistant cryptography is used, the risk of it being cracked is low.

[0126] Furthermore, as described above, a communication certificate is used in step S30 to perform authentication using the communication certificate in the communication authentication unit 41. That is, authentication for the ECC signature is performed. This verification has a shorter processing time compared to PQC signature verification, and since it is used in everyday communication where response speed is important, the verification can be completed in a very short time. Everyday communication means communication performed at a high frequency.

[0127] Thus, when using two types of certificates for communication, by using a device certificate with a PQC signature when issuing the communication certificate and a communication certificate with an ECC signature during daily communication, it is possible to achieve both the security of communication using the communication terminal 20 and the convenience of the communication terminal 20.

[0128] In addition, in this embodiment, one-way authentication is performed as the authentication method in the first authentication communication and the second authentication communication. Figure 6 This diagram illustrates an example of a one-way authentication protocol (based on elliptic cryptography) involved in this implementation. Furthermore, Figure 6The one-way authentication protocol shown is known, so the explanation is simplified. In the first authentication communication, "Device" refers to the communication terminal 20, and "Server" refers to the certificate authority 30. In the second authentication communication, "Device" refers to the communication terminal 20, and "Server" refers to the server device 40. The following explanation uses the first authentication communication as an example.

[0129] Figure 6 The “Dcert” shown represents the device certificate, “Sn”, “Dk”, “Dv”, “Sk”, and “Sv” represent random values ​​(random numbers), “Dpriv” represents the private key owned by the device, and “Dpub” represents the public key that is paired with “Dpriv”.

[0130] like Figure 6 As shown, the certificate issuance delegation department 22 of the communication terminal 20 sends the device certificate to the communication certificate issuing authority 30.

[0131] Next, the device authentication department 31 of the communication certificate issuing authority 30 uses the public key contained in the device certificate issuing authority certificate to verify the signature of the device certificate (in this case, a PQC signature). For example, the device authentication department 31 uses the public key contained in the device certificate issuing authority certificate to determine whether the signature of the device certificate is correct.

[0132] Next, in order to verify whether the communication terminal 20 has a private key that is paired with the public key contained in the device certificate, the device authentication unit 31 generates a random value Sn and sends it to the communication terminal 20.

[0133] Next, the certificate issuance delegation 22 generates a random value Dk, and generates a random value Dv by multiplying the random value Dk by the base point G (Gon EC) of the elliptic curve. Using the private key stored in the third storage section 21, the random values ​​Sn and Dv are signed and sent to the communication certificate issuing authority 30.

[0134] Next, the device authentication unit 31 uses the public key contained in the device certificate to verify the information sent from the certificate issuance delegation unit 22 (that is, whether the signature is correct). Authentication is completed upon confirmation that the signature is correct.

[0135] Next, after the device authentication unit 31 confirms that the communication terminal 20 has a private key that is paired with the public key contained in the device certificate through authentication, it generates a random value Sk, generates a random value Sv by multiplying the random value Sk by the base point G of the elliptic curve, and sends the random value Sv to the communication terminal 20.

[0136] Next, the session key is exchanged between the certificate issuance delegation unit 22 and the device authentication unit 31. This session key is used when the communication certificate and private key are sent from the communication certificate signing unit 33 to the communication terminal 20.

[0137] In addition, in the second authentication communication, the communication certificate is used as "Dcert".

[0138] (A variation of Implementation Method 1)

[0139] The following is for reference Figure 7 and Figure 8 The certificates used in the communication system of this modification will be described. Furthermore, the following description focuses on the differences from Embodiment 1; content that is the same as or similar to Embodiment 1 will be omitted or simplified. Additionally, the functional structure of the communication system of this modification may also be similar to... Figure 1 The communication system 1 shown is the same, and the following description will use the reference numerals used in the communication system 1 according to Embodiment 1.

[0140] Figure 7 This is a diagram representing the data structure of the device certificate involved in this variation.

[0141] like Figure 7 As shown, the equipment certificate involved in this variation is in Figure 2 The device certificate shown also includes an ECC public key and an ECC signature. The ECC public key is an example of a third-party public key, and the ECC signature is an example of a third-party signature.

[0142] Therefore, when authenticating the communication terminal 20, the device authentication unit 31 can choose to use either the ECC signature or the PQC signature. For example, if one of the first private key encryption method and the second private key encryption method is compromised, the device authentication unit 31 will use the public key and signature of the other private key encryption method (the uncompromised private key encryption method) to authenticate the communication terminal 20.

[0143] The device authentication unit 31 can also switch the public key and signature used for authentication from the third public key and third signature to the first public key and first signature if the second private key encryption method is compromised during the authentication of the communication terminal 20. For example, the device authentication unit 31 can also use an ECC signature for authentication until the current encryption method is compromised. Whether the encryption method has been compromised can be determined based on the guidelines of a public organization (e.g., the IPA (Information-technology Promotion Agency) in Japan) or by the manufacturer of the communication terminal 20.

[0144] Furthermore, the communication processing delegation unit 24 uses a common second public key and second signature as the public key and signature for the second authentication communication, both before and after the second private key encryption method is compromised. In other words, the communication processing delegation unit 24 uses the second public key and second signature regardless of whether the second private key encryption method is compromised.

[0145] Furthermore, the ECC private key and the corresponding ECC public key are generated by the device key pair generation unit 11. That is, the device key pair generation unit 11 generates two key pairs.

[0146] Figure 8 This is a diagram representing the data structure of the communication certificate involved in this variation.

[0147] like Figure 8 As shown, the communication certificate involved in this variation is... Figure 4 The communication certificate shown also includes a PQC signature. The PQC signature is an example of a fourth type of signature.

[0148] Therefore, when verifying the communication terminal 20, the communication authentication unit 41 can choose to use either the ECC signature or the PQC signature for authentication. In most cases, the server device 40 has a faster processing speed (more abundant computing resources) compared to the communication terminal 20. The server device 40 can also determine whether to use the ECC signature or the PQC signature based on its own processing speed. For example, the server device 40 can use the PQC signature for authentication if its processing speed is above a predetermined value, and use the ECC signature for authentication if its processing speed is below a predetermined value. Alternatively, the server device 40 can use the PQC signature instead of the ECC signature for authentication if its processing speed is above a predetermined value.

[0149] Thus, when the communication certificate contains both an ECC signature and a PQC signature, the communication authentication unit 41 can also use a signature determined by the response speed of the device for authentication.

[0150] (Implementation Method 2)

[0151] The following is for reference Figures 9-11 The communication system involved in this embodiment will be described. Furthermore, the following description focuses on the differences from Embodiment 1, and the description of the same or similar content as Embodiment 1 will be omitted or simplified.

[0152] [2-1. The Composition of a Communication System]

[0153] First, refer to Figure 9 and Figure 10 The configuration of the communication system involved in this embodiment will be described. Figure 9 This is a block diagram illustrating the functional structure of the communication system 1a according to this embodiment. The difference between the communication system 1a according to this embodiment and the communication system 1 according to Embodiment 1 is that, as an authentication between devices, two-way authentication is performed.

[0154] like Figure 9 As shown, communication system 1a includes server device 40a instead of server device 40 in communication system 1. In addition to the communication authentication unit 41 according to embodiment 1, server device 40a also has a seventh storage unit 42 for storing server certificates and private keys. The server certificate and private key stored in the seventh storage unit 42 are used in the case of mutual authentication between communication terminal 20 and server device 40a. Furthermore, the private key stored in the seventh storage unit 42 is the same as the public key contained in the server certificate (e.g., in...). Figure 10 In the example, the private key is the ECC public key paired with the public key.

[0155] Figure 10 This is a diagram illustrating the data structure of the server certificate involved in this implementation.

[0156] like Figure 10 As shown, the server certificate includes a header, certificate serial number, signer information, validity period, ECC public key, and ECC signature. In the case of two-way authentication, communication terminal 20 uses the server certificate to authenticate whether server device 40a is a legitimate device. In most cases, communication terminal 20 is slower than server device 40a in processing speed. From a convenience perspective, the server certificate only contains the ECC signature and the ECC signature from the PQC signature.

[0157] The header stores header information such as the format and version of the server certificate.

[0158] For the certificate serial number, save the number used to identify the server certificate.

[0159] The signer information stores information about the authority that signed the server certificate, that is, the authority that issued the server certificate. For example, the signer information may include information about the certification authority that issued the server certificate.

[0160] The validity period indicates the duration during which a server certificate can be used effectively.

[0161] For the ECC public key, the ECC public key is stored in pairs with the private key stored in the seventh storage unit 42.

[0162] For ECC signatures, the signature (signature value) is stored using the private key held by the authority that issued the server certificate.

[0163] This server certificate is used when communication terminal 20 and server device 40a perform mutual authentication.

[0164] Refer again Figure 9 The device authentication department 31 of the communication certificate issuing authority 30 obtains the second private key from the fifth storage department 34 and the communication certificate issuing authority certificate from the sixth storage department 35.

[0165] [2-2. Operation of the Communication System]

[0166] Next, refer to Figure 11 The operation of the communication system 1a configured as described above will be explained. Furthermore, the operation of the communication system 1a can be related to... Figure 5 The actions shown are the same; the following is an explanation of two-way authentication.

[0167] Figure 11 This is a flowchart illustrating the operation (communication method) of the communication system 1a according to this embodiment. Figure 11 This diagram illustrates an example of the two-way authentication protocol (based on elliptic cryptography) involved in this implementation. Furthermore, Figure 11 The two-way authentication protocol shown is known, so a simplified explanation is provided. Furthermore, the following mainly focuses on... Figure 6 The different processing methods for one-way authentication are explained below.

[0168] In the first authentication communication, "Device" refers to communication terminal 20, and "Server" refers to the certificate authority 30. In the second authentication communication, "Device" refers to communication terminal 20, and "Server" refers to server device 40a. The following explanation uses the first authentication communication as an example. Additionally, Figure 11 The “Scert” shown indicates a Certificate Authority Certificate.

[0169] like Figure 11 As shown, the certificate issuance delegation unit 22 of the communication terminal 20 generates a random value Dn, and then combines the generated random value Dn with the device certificate (see reference). Figure 2 or Figure 7 Send to the communication certificate issuing authority 30.

[0170] Next, the device authentication unit 31 of the communication certificate issuing authority 30 uses the public key contained in the device certificate issuing authority certificate to verify the signature (e.g., PQC signature) of the device certificate. Additionally, the device authentication unit 31 generates a random value Sn and compares the generated random value Sn with the communication certificate issuing authority certificate (e.g., referenced...) Figure 3 ) is sent to communication terminal 20.

[0171] Next, the Certificate Issuance Delegation Unit 22 uses the public key paired with the second private key to verify whether the signature (e.g., PQC signature) of the Communication Certificate Issuance Authority certificate is correct.

[0172] Next, the device authentication unit 31 generates a random value Sk, and generates a random value Sv by multiplying the random value Sk by the base point G (G onEC) of the elliptic curve. Using the second private key stored in the fifth storage unit 34, the random values ​​Dn and Sv are signed and sent to the communication terminal 20.

[0173] Next, the certificate issuance delegation unit 22 uses the public key paired with the second private key to verify whether the signature (e.g., a PQC signature) obtained from the device authentication unit 31 is correct. This determines whether the communication certificate issuing authority 30 possesses the second private key paired with the public key. In other words, the certificate issuance delegation unit 22 performs the verification of whether the communication certificate issuing authority 30 is a legitimate authority.

[0174] Next, the certificate issuance delegation 22 generates a random value Dk, and generates a random value Dv by multiplying the random value Dk by the base point G of the elliptic curve. Using the private key stored in the third storage section 21, it adds a signature to the random values ​​Sn and Dv and sends them to the communication certificate issuing authority 30.

[0175] Next, the device authentication unit 31 uses the public key contained in the device certificate issuing authority's certificate to verify whether the signature (e.g., a PQC signature) obtained from the certificate issuance delegation unit 22 is correct. This determines whether the communication terminal 20 possesses the private key (the private key paired with the public key of the device certificate) issued by the device certificate issuing authority 10. In other words, the communication certificate issuing authority 30 performs the verification of whether the communication terminal 20 is a valid terminal.

[0176] Next, if all authentications are successful, the session key is exchanged between the certificate issuance delegation unit 22 and the device authentication unit 31. This session key is used when the communication certificate and private key are sent from the communication certificate signing unit 33 to the communication terminal 20.

[0177] (Regarding combinations of encryption methods)

[0178] Next, refer to Figures 12-14 The combination of encryption methods in a communication system configured as described above will be explained. Figure 12 This diagram illustrates the combination of encryption methods used when issuing certificates through a proxy. Authentication methods include one-way and two-way authentication, and the processing includes terminal certificate verification, terminal-side verification, key exchange, server certificate verification, and server-side verification. Furthermore, terminal certificate verification refers to the verification of the device certificate possessed by the communication terminal 20.

[0179] like Figure 12 As shown, PQC-based processing is performed in both the communication terminal-side processing (processing executed by communication terminal 20) and the server-side processing (processing executed by server device 40a). For example, when the processing involves terminal certificate verification, PQC verification for PQC signature verification is performed in server device 40a. Furthermore, when the processing involves terminal-side authentication, PQC signature issuance is performed in communication terminal 20, and PQC verification for the PQC signature issued in communication terminal 20 is performed in server device 40a. Additionally, when the processing involves key exchange, both communication terminal 20 and server device 40a perform processing for exchanging PQC keys. Finally, when the processing involves server certificate authentication, PQC verification for the PQC signature of the server certificate obtained from server device 40a is performed in communication terminal 20. In addition, when the processing content is server-side authentication, the process of giving a PQC signature is performed in the server device 40a, and the PQC verification of the PQC signature given in the server device 40a is performed in the communication terminal 20.

[0180] In addition, Figure 12 The areas marked with an asterisk (*) indicate that, for example, before the current encryption method is compromised, the existing encryption method (e.g., ECC) can be used instead of PQC. Figure 13 and Figure 14 The same applies to China.

[0181] Figure 13 This is a diagram illustrating the combination of encryption methods used in delegated communication processing. Figure 13In Chinese, when using existing encryption methods, it is denoted as "current". For example, when signing using existing encryption methods, it is denoted as "current signature".

[0182] like Figure 13 As shown, in routine communication between communication terminal 20 and server device 40a, the existing encryption method is primarily used. Furthermore, when the processing involves terminal certificate verification, PQC verification is performed in server device 40a. This means that server device 40a performs PQC verification under the assumption that computing resources are abundant and processing speed is higher than predetermined. For example, existing verification can also be performed in server device 40a before the existing encryption method is compromised.

[0183] Figure 14 This diagram represents a combination of encryption methods used when entrusting the renewal or reissue of certificates.

[0184] like Figure 14 As shown, when the communication certificate is updated or reissued, authentication and key exchange using PQC are performed. Furthermore, in the case of an update, processing can also be performed at scheduled times, such as when the device is not in operation, even if the processing takes time.

[0185] (Other implementation methods)

[0186] The communication system and the like described above, based on the embodiments, have been explained in one or more ways, but this disclosure is not limited to these embodiments. As long as it does not depart from the spirit of this disclosure, various modifications that can be conceived by those skilled in the art to these embodiments, and ways of constructing by combining the constituent elements of different embodiments, may also be included in this disclosure.

[0187] For example, in the above embodiments, the case where the private key (the first private key generated by the device key pair generation unit 11) stored in the third storage unit 21 and the private key stored in the fourth storage unit 23 are different private keys has been described, but it is not limited to this, and the two private keys may also be the same private key.

[0188] Furthermore, in the above embodiments, an example was described in which the communication terminal 20 communicates with the server device 40a using two types of certificates, but the number of certificates used is not limited to two types, and may be three or more types.

[0189] Furthermore, in the above-described embodiments, each component can be constructed using dedicated hardware, or it can be implemented by executing software programs suitable for each component. Each component can also be implemented by a program execution unit such as a CPU or processor reading and executing software programs recorded on a recording medium such as a hard disk or semiconductor memory.

[0190] Furthermore, the order in which the steps in the flowchart are executed is illustrative for the purpose of specifically illustrating this disclosure, and may also be in a different order than described above. Additionally, some of the aforementioned steps may be executed simultaneously (in parallel) with other steps, or some of the aforementioned steps may not be executed at all.

[0191] Furthermore, taking the division of functional blocks in the block diagram as an example, multiple functional blocks can also be implemented as a single functional block, a single functional block can be divided into multiple functional blocks, or a portion of the functionality can be transferred to other functional blocks. Alternatively, a single piece of hardware or software can process the functionality of multiple functional blocks with similar functions in parallel or time-division multiplexing.

[0192] Furthermore, the communication terminal described in the above embodiments can be implemented as a single device or by multiple devices. When the communication terminal is implemented by multiple devices, the various components of the communication terminal can be distributed among the multiple devices in any manner. When the communication terminal is implemented by multiple devices, the communication method between these multiple devices is not particularly limited; it can be wireless communication or wired communication. Additionally, wireless communication and wired communication can be combined between the devices.

[0193] Furthermore, the constituent elements described in the above embodiments can also be implemented as software, typically as LSIs as integrated circuits. They can be implemented as individual chips or as chips that include some or all of them. Although referred to as LSIs here, they are sometimes called ICs, system LSIs, very large LSIs, or extra-large LSIs, depending on the level of integration. In addition, the method of integrated circuit implementation is not limited to LSIs; it can also be implemented by application-specific circuits (general-purpose circuits that execute special programs) or general-purpose processors. FPGAs (Field Programmable Gate Arrays) that are programmable after LSI manufacturing, or reconfigurable processors that can reconfigure the connections or settings of the circuit cells inside the LSI, can also be used. Moreover, if an integrated circuit implementation technology that replaces LSIs emerges due to advancements in semiconductor technology or other derived technologies, then this technology can certainly be used for the integration of constituent elements.

[0194] A system LSI is a multifunctional LSI that integrates multiple processing units onto a single chip. Specifically, it is a computer system comprising a microprocessor, ROM (Read Only Memory), RAM (Random Access Memory), and other components. The ROM stores the computer program. The microprocessor operates according to the computer program, thus enabling the system LSI to perform its functions.

[0195] Alternatively, this disclosure can also be implemented by having a computer execute... Figure 5 , Figure 6 and Figure 11 The computer program comprising the unique steps of any of the communication methods shown.

[0196] Alternatively, for example, the program can also be a program for causing a computer to execute. Another aspect of this disclosure can be a computer-readable, non-transitory recording medium on which such a program is recorded. For example, such a program can be recorded on a recording medium for distribution or circulation. For example, the distributed program can be installed on other devices having a processor, and by causing the processor to execute the program, the device can perform the aforementioned processes.

[0197] Industrial availability

[0198] This disclosure is useful for communication methods, such as those using two certificates for communication.

[0199] Explanation of reference numerals in the attached figures

[0200] 1, 1a: Communication system

[0201] 10: Equipment Certificate Issuing Authority

[0202] 11, 32: Device Key Pair Generation Unit

[0203] 12: First Storage Unit (Storage Unit)

[0204] 13: Equipment Certificate Signature Department

[0205] 14: Second Storage Section

[0206] 20: Communication terminal

[0207] 21: Third Storage Division

[0208] 22: Certificate Issuance Department (First Certification Communications Department)

[0209] 23: Fourth Storage Department (Acquisition Department)

[0210] 24: Communications Processing Department (Second Authentication Communications Department)

[0211] 30: Telecommunications Certificate Issuing Authority

[0212] 31: Equipment Certification Department

[0213] 33: Communication Certificate Signature Department

[0214] 34: Fifth Storage Division

[0215] 35: Sixth Storage Division

[0216] 40, 40a: Server equipment

[0217] 41: Communications Certification Department

[0218] 42: Seventh Storage Division

Claims

1. A communication method, which is a communication method of a communication terminal having a storage unit, the storage unit storing a pre-given first certificate, the communication method comprising: Use the first certificate to perform the first authentication communication with the first device; A second certificate, different from the first certificate, is obtained through the first authentication communication; and The obtained second certificate is used to perform second authentication communication with a second device that is different from the first device. The first certificate contains a first public key and a first signature encrypted using a first private key. The second certificate contains a second public key and a second signature, which are encrypted using a second private key encryption method different from the first private key encryption method.

2. The communication method according to claim 1, The first certificate also contains a third public key and a third signature encrypted using the second private key.

3. The communication method according to claim 1 or 2, The second certificate also contains a fourth signature encrypted using the first private key.

4. The communication method according to claim 1 or 2, The first private key encryption method is a quantum-resistant cryptographic encryption method. The second private key encryption method is an encryption method that uses a different cryptography than the quantum-resistant cryptography.

5. The communication method according to claim 1 or 2, The validity period of the first certificate is longer than that of the second certificate.

6. A communication terminal, comprising: The storage unit stores the first certificate pre-granted to the communication terminal; The first authentication communication unit uses the first certificate to perform first authentication communication with the first device; The acquisition unit obtains a second certificate, different from the first certificate, through the first authentication communication; as well as The second authentication communication unit uses the second certificate obtained by the acquisition unit to perform second authentication communication with a second device different from the first device. The first certificate contains a first public key and a first signature encrypted using a first private key. The second certificate contains a second public key and a second signature, which are encrypted using a second private key encryption method different from the first private key encryption method.

7. The communication terminal according to claim 6, The first certificate also contains a third public key and a third signature encrypted using the second private key.

8. A communication system, comprising: The communication terminal as described in claim 7; and If one of the first private key encryption method and the second private key encryption method is compromised, the first device performs the first authentication communication using the public key and signature of the other private key encryption method.

9. The communication system according to claim 8, If, during the first authentication communication using the third public key and the third signature encrypted with the second private key, the first device switches the public key and signature used for the first authentication communication from the third public key and the third signature to the first public key and the first signature if the second private key encryption method fails. Before and after the second private key encryption method fails, the second authentication communication unit uses the second public key and the second signature as the public key and signature for the second authentication communication.

Images