Key management system and key management method

Abstract

To provide a method for copying, between terminals, an authentication key for accessing a server with simple configuration or low costs.SOLUTION: A first terminal includes a storage section in which a secret key and a first security code are stored. A second terminal includes a storage section in which a second security code is stored. The first terminal creates an encrypted counter code by encrypting a counter code using the first security code and transmits the encrypted counter code to a server. The server transmits the encrypted counter code and a public key corresponding to the secret key to the second terminal. The second terminal creates a re-encrypted counter code by encrypting, using the public key, a result obtained by decrypting the encrypted counter code using the second security code. When a result obtained by decrypting the re-encrypted counter code using the secret key agrees with the counter code, the first terminal transmits the secret key to the second terminal.SELECTED DRAWING: Figure 4

Description

[Technical Field]

[0001] The present invention relates to a system and method for sharing an authentication key between terminals to be used when accessing a server. [Background technology]

[0002] In a system in which an authentication key is used to access a server, the authentication key is registered in advance in the server and the client terminal. When a client terminal is replaced in such a system, the authentication key is re-registered in the server and the new client terminal. However, re-registering the authentication key is a heavy burden for the system administrator. Therefore, a method of copying the authentication key between terminals has been proposed (for example, see Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 6479723 Summary of the Invention [Problem to be solved by the invention]

[0004] As described above, methods for copying authentication keys between terminals have been proposed. However, conventional techniques can increase the cost of copying authentication keys between terminals. For example, in the system described in Patent Document 1, copying of an authentication key is permitted after user authentication such as biometric authentication is performed on both the copy source terminal and the copy destination terminal. In other words, conventional techniques require dedicated equipment such as a biometric authentication device to ensure security, which increases costs.

[0005] An object of one aspect of the present invention is to provide a method for copying an authentication key for accessing a server between terminals with a simple configuration or at low cost. [Means for solving the problem]

[0006] A key management system according to one aspect of the present invention manages private keys used by a first terminal and a second terminal when accessing a server. The first terminal includes a first storage unit and a first key management unit. The second terminal includes a second storage unit and a second key management unit. The first storage unit stores the private key and a first security code in advance. The second storage unit stores a second security code in advance. The server holds a public key corresponding to the private key. The first key management unit generates a predetermined counter code, encrypts the counter code with the first security code to generate an encrypted counter code, and transmits the encrypted counter code to the server. The server transmits the encrypted counter code and the public key to the second terminal. The second key management unit decrypts the encrypted counter code with the second security code to generate a decrypted counter code, and encrypts the decrypted counter code with the public key to generate a re-encrypted counter code. The first key management unit generates a re-decryption counter code by decrypting the re-encrypted counter code with the private key, and when the counter code matches the re-decryption counter code, transmits the private key to the second terminal. [Effects of the Invention]

[0007] According to the above-described aspect, an authentication key for accessing a server can be copied between terminals with a simple configuration or at low cost. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram illustrating an example of a client-server system according to an embodiment of the present invention. [Figure 2] FIG. 2 is a diagram illustrating an example of a configuration of a terminal according to an embodiment of the present invention. [Figure 3] FIG. 10 is a diagram illustrating an example of a case in which an existing terminal is replaced with a new terminal in a client-server system. [Figure 4] FIG. 10 is a sequence diagram illustrating an example of a procedure for copying a private key between terminals. DETAILED DESCRIPTION OF THE INVENTION

[0009] 1 shows an example of a client-server system according to an embodiment of the present invention. In this example, a server 1 provides services to a terminal 11 and a terminal 12. The terminals 11 and 12 are each clients of the server 1. That is, each of the terminals 11 and 12 can receive the services provided by the server 1.

[0010] Each terminal (11, 12) holds an authentication key for accessing the server 1. In this embodiment, access to the server 1 is authenticated using public key cryptography. Therefore, the terminal 11 holds a private key SK01, and the terminal 12 holds a private key SK02. The server 1 holds public keys corresponding to the private keys used by each terminal (11, 12). In this embodiment, the server 1 holds a public key PK01 corresponding to the private key SK01 and a public key PK02 corresponding to the private key SK02.

[0011] When terminal 11 accesses server 1, terminal 11 sends a message generated based on, for example, private key SK01 to server 1, and server 1 authenticates the received message using public key PK01. If this authentication is successful, server 1 permits access by terminal 11. The same procedure is followed when terminal 12 accesses server 1.

[0012] In the client-server system configured as described above, it is assumed that the terminal 12 is replaced with a new terminal 12B. In this case, a new authentication key pair (i.e., a private key and a public key) may be generated and registered in the terminal 12B and the server 1, but this procedure places a heavy burden on the administrator of the client-server system. Therefore, in the key management method according to an embodiment of the present invention, the private key SK02 is copied from the existing terminal 12 to the new terminal 12B. Thereafter, the terminal 12B accesses the server 1 using the private key SK02 received from the terminal 12. In the following description, the terminal that transmits the private key (terminal 12 in FIG. 1) may be referred to as the "copy source terminal." Furthermore, the terminal that receives the private key (terminal 12B in FIG. 1) may be referred to as the "copy destination terminal."

[0013] 2 shows an example of the configuration of a terminal according to an embodiment of the present invention. Terminal 20 according to the embodiment of the present invention has a normal area and a secure area. Terminal 20 shown in FIG. 2 corresponds to terminal 11, 12, or 12B shown in FIG. 1.

[0014] The normal area is equipped with normal storage and processor resources. The normal storage stores an operating system and various application programs. The processor resources then execute the various application programs on the operating system to provide the functions of the terminal 20.

[0015] The secure area includes a secure storage 21. A private key and a security code are stored in the secure storage 21. Here, the security code is written to the secure storage 21 by, for example, the manufacturer of the terminal 20 before the terminal 20 is shipped. The private key is written to the secure storage 21 by, for example, an administrator of the client-server system.

[0016] The security code is, for example, a bit pattern of a predetermined length. The security code is generated for each terminal. The manufacturer of the terminal 20 manages the security codes assigned to the terminals that it manufactures. That is, the manufacturer of the terminal 20 manages the values ​​of the security codes assigned to each terminal. Note that the security code written in the secure storage 21 of each terminal 20 is basically known only to the manufacturer of the terminal 20. That is, even the user of the terminal 20 or the administrator of the client-server system cannot read the security code stored in the secure storage 21.

[0017] The private key is an authentication key (or encryption key) used by the terminal 20 when accessing the server 1. Here, a private key is generated for each terminal. A public key corresponding to the private key is also generated. The public key is distributed to a party with whom the terminal 20 will perform encrypted communication. In this embodiment, the server 1 acquires and holds a public key corresponding to the private key of the terminal 20. The public key is generated, for example, based on the private key. However, the private key is never generated based on the public key.

[0018] A key management unit 22 is implemented in the secure area. The key management unit 22 is realized by using processor resources to execute an application program for copying private keys between terminals. The key management unit 22 can also access information stored in the secure storage 21. For example, the key management unit 22 can access a security code stored in the secure storage 21 in the procedure for copying private keys between terminals. Furthermore, the key management unit 22 generates a counter code to be used in the procedure for copying private keys between terminals. The counter code is not particularly limited, but may be, for example, a pseudo-random number generated using a random number generator. Alternatively, the counter code may be a passcode equivalent to a general one-time password.

[0019] When the terminal 20 accesses the server 1, it uses the private key stored in the secure storage 21. At this time, the application program accessing the server 1 may obtain the private key via the key management unit 22.

[0020] 3 shows an example of a case where an existing terminal is replaced with a new terminal in a client-server system. In this case, the existing terminal 20A is replaced with a new terminal 20B. The configurations and functions of terminal 20A and terminal 20B are substantially the same as those of terminal 20 shown in FIG. 2. Therefore, terminal 20A and / or terminal 20B may be collectively referred to as "terminal 20."

[0021] A security code Q1 and a private key SK1 are written in the secure storage 21A of the terminal 20A. The security code Q1 is written by the manufacturer of the terminal 20A before shipping the terminal 20. The private key SK1 is written, for example, by an administrator of the client-server system.

[0022] A security code Q2 is written in the secure storage 21B of the terminal 20B. The security code Q2 was also written by the manufacturer of the terminal 20 before shipping the terminal 20B. Here, it is assumed that the manufacturer of the terminal 20 is aware that the terminal 20A will be replaced with the terminal 20B. That is, the manufacturer of the terminal 20 is aware that the terminal 20B is a replacement for the terminal 20A. In this case, the manufacturer of the terminal 20 writes the same security code as the security code held by the terminal 20A into the secure storage 21B of the terminal 20B. That is, the value of the security code Q2 stored in the secure storage 21B of the terminal 20B is the same as the security code Q1 stored in the secure storage 21B of the terminal 20A. At this point, the private key has not yet been stored in the secure storage 21B of the terminal 20B.

[0023] The server 1 holds a public key PK1 corresponding to the private key SK1 of the terminal 20A. When the terminal 20A accesses the server 1, it sends a message encrypted with the private key SK1 to the server 1, and the server 1 decrypts the message with the public key PK1. In other words, communication between the terminal 20A and the server 1 has been authenticated.

[0024] In contrast, terminal 20B does not hold the private key and has not been authenticated by server 1. In other words, it is not preferable to directly connect terminal 20B to server 1 at this point. Therefore, when copying the private key from terminal 20A to terminal 20B, an information processing device (PC) 2 is provided between terminal 20B and server 1. That is, the information processing device 2 is connected to server 1, and terminal 20B is connected to information processing device 2. The information processing device 2 is not particularly limited and may be a general personal computer. However, it is assumed that the information processing device 2 has been authenticated by server 1.

[0025] FIG. 4 is a sequence diagram showing an example of a procedure for copying a private key between terminals. In this example, private key SK1 is copied from terminal 20A shown in FIG. 3 to terminal 20B. That is, private key SK1 and security code Q1 are stored in secure storage 21A of terminal 20A, and security code Q2 is stored in secure storage 21B of terminal 20B. Security code Q1 and security code Q2 are the same. Then, an administrator of the client-server system connects terminal 20B to server 1 via information processing device (PC) 2. However, information processing device 2 is omitted in FIG. 4. Furthermore, in the description of the sequence shown in FIG. 4, description of information processing device 2 is omitted for the sake of brevity.

[0026] In S1, the terminal 20A generates a counter code C1. In S2, the terminal 20A encrypts the counter code C1 with a security code Q1. This encryption process generates the encrypted counter code C1. Note that the processes of S1 to S2 are executed by the key management unit 22A.

[0027] In S3, the terminal 20A transmits the encrypted counter code C1 generated in S2 to the server 1. Note that "C1 [Q1]" shown in Fig. 4 indicates that the counter code C1 has been encrypted with the security code Q1.

[0028] In S4, when the server 1 receives the encrypted counter code C1 from the terminal 20A, it acquires a public key corresponding to the private key of the terminal 20A. That is, the server 1 acquires a public key PK1 corresponding to the private key SK1 of the terminal 20A. The server 1 stores the public keys of each authenticated terminal 20 in its own storage device. The server 1 then transmits the encrypted counter code C1 received from the terminal 20A and the public key PK1 acquired from its own storage device to the terminal 20B.

[0029] In S5, the terminal 20B generates a decrypted counter code C1 by decrypting the encrypted counter code C1 received from the server 1 with the security code Q2. That is, the counter code C1 encrypted in the terminal 20A using the security code Q1 is decrypted using the security code Q2. Here, the security code Q1 held by the terminal 20A and the security code Q2 held by the terminal 20B are the same. Therefore, the decrypted counter code C1 obtained by this decryption process is the same as the counter code C1 generated by the terminal 20A in S1.

[0030] In S6, the terminal 20B encrypts the decryption counter code C1 generated in S5 with the public key PK1 received from the server 1. This encryption process generates a re-encrypted counter code C1. The processes of S5 and S6 are executed by the key management unit 22B.

[0031] In S7, the terminal 20B transmits the re-encrypted counter code C1 generated in S6 to the server 1. The server 1 then transfers the re-encrypted counter code C1 to the terminal 20A. Note that "C1 [PK1]" in Fig. 4 indicates that the counter code C1 has been encrypted with the public key PK1.

[0032] In S8, the terminal 20A decrypts the re-encrypted counter code C1 received from the server 1 with the private key SK1. Here, the public key PK1 used by the terminal 20B to encrypt the counter code C1 and the private key SK1 used by the terminal 20A to decrypt the re-encrypted counter code C1 correspond to each other and constitute an authentication key pair. Therefore, the counter code C1 (re-decrypted counter code C1) is reproduced by this decryption process.

[0033] In S9, the terminal 20A compares the counter code C1 generated in S1 with the re-decoded counter code C1 obtained in S8. In this embodiment, the counter code C1 generated by the terminal 20A is transmitted to the terminal 20B, and the terminal 20B returns the counter code C1 to the terminal 20A. Therefore, the counter code C1 generated in S1 and the re-decoded counter code C1 obtained in S8 match each other.

[0034] Here, if it is assumed that terminal 20B does not hold the same security code as security code Q1, terminal 20B will not be able to reproduce counter code C1 in S5. If terminal 20B cannot reproduce counter code C1, terminal 20A will not receive counter code C1 from terminal 20B. In other words, when terminal 20A receives counter code C1 from terminal 20B (i.e., when the counter code C1 generated in S1 and the re-decoded counter code C1 obtained in S8 match each other), it is considered that the same security code is written in terminal 20A and terminal 20B. Therefore, when the counter code received from terminal 20B matches the counter code generated by terminal 20A itself, terminal 20A determines that terminal 20B is a valid destination to copy the private key.

[0035] Then, in S10, terminal 20A encrypts private key SK1 stored in its own secure storage 21A with security code Q1. In this way, encrypted private key SK1 is generated. Note that the processes of S8 to S10 are executed by key management unit 22A.

[0036] In S11, the terminal 20A transmits the encrypted private key SK1 to the server 1. The server 1 transfers the encrypted private key SK1 to the terminal 20B. Note that "SK1 [Q1]" shown in Fig. 4 indicates that the private key SK1 has been encrypted with the security code Q1.

[0037] In S12, terminal 20B decrypts encrypted private key SK1 transmitted from terminal 20A using security code Q2. That is, the private key encrypted in terminal 20A using security code Q2 is decrypted using security code Q2. Here, as described above, security code Q1 and security code Q2 are the same. Therefore, this decryption process reproduces private key SK1. Then, in S13, terminal 20B stores private key SK1 in its own secure storage 21B. Note that the processes of S12 and S13 are executed by key management unit 22B. Thereafter, in S14, terminal 20B transmits a receipt notification indicating that private key SK1 has been received to terminal 20A.

[0038] In S15, the terminal 20B discards the counter code C1 in response to storing the private key SK1 in the secure storage 21B. Also, in S16, the terminal 20A discards the counter code C1 in response to receiving the acknowledgment. Furthermore, the terminal 20A may discard the private key SK1 stored in the secure storage 21A in response to receiving the acknowledgment.

[0039] If terminal 20B is not an authorized loaner, terminal 20B does not hold a security code. In this case, terminal 20B cannot reproduce counter code C1 in S5. Furthermore, if the security code held by terminal 20B is different from security code Q1 held by terminal 20A, terminal 20B cannot reproduce counter code C1 either. In either case, because terminal 20A cannot receive counter code C1 from terminal 20B, it can recognize that terminal 20B is not an authorized loaner.

[0040] As described above, in the key management method according to the embodiment of the present invention, when a private key for accessing a server is copied between terminals, the server provides the destination terminal with a public key corresponding to the private key, and the counter code is encrypted and exchanged with a security code known only to the terminal manufacturer, thereby confirming that the destination terminal is a legitimate destination terminal. Therefore, the private key can be securely copied from an existing terminal to a new terminal without re-registering the authentication key on the server and the new terminal. In other words, the private key can be securely set in the new terminal while reducing the burden on the administrator of the client-server system. Additionally, the procedure according to the embodiment of the present invention does not require dedicated equipment such as a biometric authentication device when copying the private key between terminals.

[0041] In the example shown in FIG. 4, the private key is encrypted with a security code and transmitted to the destination terminal, but the embodiment of the present invention is not limited to this procedure. For example, the source terminal may generate a key encryption key for encrypting the private key. In this case, the source terminal encrypts the key encryption key with a security code and transmits it to the destination terminal, and the destination terminal obtains the key encryption key by decrypting the received data using its own security code. Thereafter, the source terminal encrypts the private key with the key encryption key and transmits it to the destination terminal, and the destination terminal obtains the private key by decrypting the received data with the obtained key encryption key. This procedure is expected to further improve security compared to the procedure shown in FIG. 4. [Explanation of symbols]

[0042] 1 server 11, 12, 12B terminals 20, 20A, 20B terminals 21, 21A, 21B Secure Storage 22, 22A, 22B Key management section

Claims

1. A key management system that manages a private key used when a first terminal and a second terminal access a server, comprising: The first terminal a first storage unit; a first key management unit; The second terminal a second storage unit; and a second key management unit; the first storage unit stores the private key and a first security code in advance; a second security code is stored in advance in the second storage unit; The server holds a public key corresponding to the private key; The first key management unit generating a predetermined counter code; generating an encrypted counter code by encrypting the counter code with the first security code; sending the encrypted counter code to the server; the server transmits the encrypted counter code and the public key to the second terminal; The second key management unit generating a decrypted counter code by decrypting the encrypted counter code with the second security code; generating a re-encrypted counter code by encrypting the decrypted counter code with the public key; The first key management unit generating a re-decrypted counter code by decrypting the re-encrypted counter code with the private key; When the counter code and the re-decryption counter code match, the private key is transmitted to the second terminal.

1. A key management system comprising:

2. The process of transmitting the private key by the first key management unit to the second terminal includes: generating an encrypted private key by encrypting the private key with the first security code; transmitting the encrypted private key to the second terminal; The second key management unit obtains the private key by decrypting the encrypted private key with the second security code. The key management system of claim 1 .

3. After obtaining the private key, the second key management unit: discarding the decoded counter code; sending an acknowledgment to the first terminal indicating that the private key has been obtained; Upon receiving the acknowledgment, the first key management unit discards the counter code. The key management system of claim 2 .

4. A key management method for managing a private key used when a first terminal and a second terminal access a server, comprising: a first storage unit provided in the first terminal stores the private key and a first security code in advance; a second storage unit provided in the second terminal stores a second security code in advance; The server holds a public key corresponding to the private key; The first terminal generating a predetermined counter code; generating an encrypted counter code by encrypting the counter code with the first security code; sending the encrypted counter code to the server; the server transmits the encrypted counter code and the public key to the second terminal; The second terminal generating a decrypted counter code by decrypting the encrypted counter code with the second security code; generating a re-encrypted counter code by encrypting the decrypted counter code with the public key; The first terminal generating a re-decrypted counter code by decrypting the re-encrypted counter code with the private key; When the counter code and the re-decryption counter code match, the private key is transmitted to the second terminal. A key management method comprising:

Images