Cryptographic communication system, cryptographic communication apparatus, and cryptographic communication method

Abstract

To deliver an encryption communication system capable of maintaining security of encryption communication of a user by sharing an encryption key (common key) between two nodes via a plurality of routes using a Vernam cipher or a secret sharing method.SOLUTION: An encryption communication system shares an encryption key between a first node and a second node. The first node forms n (n> 1) systems, generates n pieces of first data that are random numbers, distributes the n pieces of first data to paths of the n systems and transmits the n pieces of first data to the second node, performs wiretapping detection for each path, and generates an encryption key based on second data obtained by reconstruction of a secret sharing scheme in which only the first data of a path in which wiretapping is not detected is regarded as distributed data. The second node receives the n pieces of first data from the first node via the paths of the n systems, performs wiretapping detection for each path, and generates an encryption key based on second data obtained by restoration of a secret sharing scheme in which only the first data of a path in which wiretapping is not detected is regarded as distributed data.SELECTED DRAWING: Figure 4

Description

[Technical Field]

[0001] FIELD Embodiments of the present invention relate to an encrypted communication system, an encrypted communication device, and an encrypted communication method. [Background technology]

[0002] There is a quantum cryptography communication system that suppresses the deterioration of security of encrypted communication due to the deterioration of reliability of intermediate nodes for extending communication distance by changing the communication means and the means of transmitting the encryption key (common key).For example, there is a technology that multiple-encrypts encrypted communication from a source node to a destination node using independent encryption keys (common keys) shared among two or more routes that pass through intermediate nodes from the source node to the destination node.

[0003] There is also a technology in which one encryption key (common key) is divided into multiple parts and shared over two or more routes from the source node to the destination node via intermediate nodes, and the encryption keys (common keys) are combined at the destination node to perform decryption.

[0004] A technique that prevents information leakage from the distributed data by dividing the data to be kept secret into multiple fragments and transmitting them is called a secret sharing scheme. One secret sharing scheme, the (k,n) threshold secret sharing scheme, divides the data to be kept secret into n pieces, and has the characteristic that the original data can be restored by collecting any k pieces of these, but even if k-1 pieces are collected, none of the information contained in the original data can be restored. The (k,n) threshold secret sharing scheme is also called a perfect secret sharing scheme.

[0005] In addition, there is a ramp secret sharing scheme, which sacrifices data confidentiality compared to perfect secret sharing schemes in order to improve transmission efficiency. For example, there is a technique for obfuscating shared data by combining random number data with the shared data and performing an exclusive OR. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Patent No. 5672425 [Patent Document 2] Patent No. 6783772 [Patent Document 3] Patent No. 5685735 Summary of the Invention [Problem to be solved by the invention]

[0007] However, these technologies have problems with fault tolerance, in that intermediate nodes in multiplexed routes can become single points of failure, and if an unauthorized eavesdropper steals part of the plaintext encryption key, part of the communication content can be decrypted, making the communication unsecure.

[0008] In addition, nesting intermediate nodes reduces the transfer distance by approximately half, which increases the costs of implementation and operation in society.

[0009] One embodiment of the present invention provides a cryptographic communication system, a cryptographic communication device, and a cryptographic communication method that can maintain the security of a user's cryptographic communication by sharing a cryptographic key (common key) between two nodes via multiple routes using the Vernam cipher or secret sharing method. [Means for solving the problem]

[0010] According to an embodiment, an encrypted communication system distributes an encryption key to a first user and a second user who perform encrypted communication. The system configures a network with multiple nodes, and shares the encryption key between a first node that distributes the encryption key to the first user and a second node that distributes the encryption key to the second user. The first node forms n (n>1) routes between the first node and the second node on the network, generates n pieces of first data that are random numbers, distributes the n pieces of first data to the n routes, and transmits them to the second node. Wire-tapping is detected for each route, and an encryption key is generated based on second data obtained by restoring the data using a secret sharing scheme in which only the first data on routes where no wiretapping was detected is considered as shared data. The second node receives the n pieces of first data from the first node via the n routes, performs wiretapping detection for each route, and generates an encryption key based on second data obtained by restoring the data using a secret sharing scheme in which only the first data on routes where no wiretapping was detected is considered as shared data. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 1 is a block diagram showing an example of the configuration of an encrypted communication system according to a first embodiment. [Figure 2] FIG. 2 is a block diagram showing an example of a functional configuration in the case where a node in a quantum cryptography communication network of the cryptographic communication system according to the first embodiment plays the role of a terminal node. [Figure 3] FIG. 2 is a block diagram showing an example of a functional configuration in the case where a node in a quantum cryptography communication network of the cryptographic communication system according to the first embodiment plays the role of an intermediate node. [Figure 4] 3 is a sequence chart showing the processing steps of the encrypted communication method executed by the encrypted communication system of the first embodiment. [Figure 5] 3 is a diagram showing an example of a method for generating a random number key by a terminal node in a quantum cryptography communication network and an example of encryption of plaintext data by a user in the cryptographic communication system of the first embodiment. FIG. [Figure 6] FIG. 10 is a block diagram showing an example of the configuration of an encrypted communication system according to a second embodiment. [Figure 7]FIG. 10 is a block diagram showing an example of a functional configuration in the case where a node in a quantum cryptography communication network of the cryptographic communication system according to the second embodiment plays the role of a terminal node. [Figure 8] 10 is a sequence chart showing the processing steps of an encrypted communication method executed by an encrypted communication system according to a second embodiment. [Figure 9] FIG. 1 shows an example of a method for generating a random number key by ramp secret sharing with a share number of 3 and a threshold value of 3 in the encryption communication system of the second embodiment. [Figure 10] FIG. 2 shows an example of a method for generating a random key by ramp secret sharing with a share number of 3 and a threshold value of 3 in the encryption communication system of the second embodiment. [Figure 11] FIG. 10 is a diagram showing an example of encryption of plaintext data by a user in the encrypted communication system according to the second embodiment. [Figure 12] FIG. 1 shows an example of a method for generating a random number key by ramp secret sharing with a share number of 3 and a threshold value of 2 in the encryption communication system of the second embodiment. [Figure 13] FIG. 2 shows an example of a method for generating a random key by ramp secret sharing with a share number of 3 and a threshold value of 2 in the encryption communication system of the second embodiment. [Figure 14] 4 is a sequence chart showing a first example of forming a route between two nodes on the quantum cryptography communication network 13 in the cryptographic communication system of the first or second embodiment. [Figure 15] FIG. 2 is a block diagram showing an example of the configuration of a route management server of the encrypted communication system according to the first or second embodiment. [Figure 16] 10 is a sequence chart showing a second example of forming a route between two nodes on the quantum cryptography communication network 13 in the cryptographic communication system of the first or second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, embodiments will be described with reference to the drawings. (First embodiment) First, the first embodiment will be described.

[0013] In the cryptographic communication system of the first embodiment, data required for generating an encryption key (hereinafter, an encryption key used on the Internet network will be referred to as a random number key) using, for example, a Vernam cipher superposition is distributed to multiple routes and transmitted and received between a source node and a destination node, and the random number key (common key) is shared. In the cryptographic communication system of the first embodiment, the two nodes deliver the shared encryption key to a user who performs cryptographic communication.

[0014] This means that even if an unauthorized eavesdropper infiltrates an intermediate node on a route and steals some of the data essential for generating the random key, the unauthorized eavesdropper will not be able to decrypt the random key, thereby maintaining the security of user communications.

[0015] 1 is a block diagram showing an example of the configuration of an encrypted communication system according to a first embodiment. The encrypted communication system according to the first embodiment distributes a random number key (encryption key) 16 for encrypted communication via a quantum cryptography communication network 13 to a user A11 (a communication device of the user A11) and a user B12 (a communication device of the user B12), who transmit and receive encrypted data 17 via an Internet network 14. The user A11 encrypts plaintext data 15 using the random number key 16 distributed from the encrypted communication system, and transmits the encrypted data 17 generated by this encryption to the user B12 via the Internet network 14. The user B12 decrypts the encrypted data 17 received from the user A11 via the Internet network 14 using the random number key 16 also distributed from the encrypted communication system, thereby obtaining the plaintext data 15. In other words, the encrypted communication system according to the first embodiment is a platform that provides a service for distributing random number keys to users who perform encrypted communication.

[0016] As shown in FIG. 1 , the cryptographic communication system of the first embodiment includes a quantum cryptography communication network (mesh) 13. The quantum cryptography communication network 13 includes a plurality of nodes, each having a quantum key distribution function, connected in a mesh pattern. The mesh connection does not necessarily mean that all adjacent nodes are connected. Some adjacent nodes may not be connected. Quantum key distribution is a technology that utilizes the behavior of quantum particles, such as photons. For example, an encryption key is generated and shared by transmitting and receiving encryption key information between nodes using photons via an optical fiber. The encryption key generated and shared between two adjacent nodes on the quantum cryptography communication network 13 using the quantum key distribution function is not a random key 16 distributed to a user, but is a encryption key for performing encrypted communication (quantum cryptography communication) between the two adjacent nodes. The random key 16 may be generated from a random key generated and shared between the terminal node C131 and an adjacent node. For example, an OTP (one-time pad) encryption method that cannot be decrypted using encrypted data alone is used for this encrypted communication.

[0017] The multiple nodes include an end node C131 connected to a user A11, an end node D132 connected to a user B12, and an intermediate node 133 located on a route formed between the end node C131 and the end node D132. Each node in the quantum cryptography communication network 13 can be either an end node that delivers a random number key 16 to a user, or an intermediate node that relays data (divided data 18 described later) required for generating the random number key 16.

[0018] When user A11 starts encrypted communication with user B12, user A11 requests the random number key 16 from terminal node C131. Note that user A11's request for the random number key 16 does not have to be made directly to terminal node C131. For example, user A11 requests the random number key 16 from a server (not shown) that centrally manages the provision service of the random number key 16. Upon receiving the request from user A11, the server transmits the request to terminal node C131 connected to user A11. The request for the random number key 16 to the server includes a specification of the communication partner. Then, for example, the server instructs terminal node D132, which is connected to user B12, who is the communication partner of user A11, to share the random number key 16 with terminal node C131 and deliver the shared random number key 16 to user B12. Conversely, the terminal node C131 is instructed to share the random number key 16 with the terminal node D132 and to deliver the shared random number key 16 to the user B12.

[0019] When the terminal node C131 receives a request for the random key 16 from the user A11, it generates multiple divided data 18 as data required to generate the random key 16. Although the term "divided data" is used, it does not mean that the data of the random key 16 is simply divided. The divided data 18 may be, for example, random numbers of the same length as the random key 16. In other words, in this case, generating multiple divided data 18 does not mean dividing the random key 16 into n equal parts to generate n pieces of divided data 18 with a data length of (x / n), where x is the data length of the random key 16, but rather means generating n pieces of divided data 18 with the same length (x) as the random key 16. Note that instead of generating random numbers as the divided data 18, a quantum key generated by a quantum key distribution function may be used as the divided data 18.

[0020] Note that the random key 16 may be continuously delivered from the terminal node C131 to the user A11 while the user A11 is performing encrypted communication over the Internet. Therefore, the divided data 18 required for generating the random key 16 is also continuously generated.

[0021] Furthermore, the terminal node C131 forms a plurality of routes between it and the terminal node D132 for allocating and transferring a plurality of divided data items 18 to different routes. The terminal node C131, for example, acquires information about the terminal node D from the server described above. Details of the formation of routes on the quantum cryptography communication network 13 will be described later. For example, the number of divided data items 18 generated is the same as the number of routes formed.

[0022] The terminal node C131 transfers (quantum key distribution) the multiple divided data 18 to multiple adjacent intermediate nodes 133, each of which forms a different route, on the quantum cryptography communication network 13, with the terminal node D132 as the intended destination. The terminal node C131 also generates a random number key 16 by superimposing the multiple divided data 18 using an exclusive OR or the like, and distributes the generated random number key 16 to the user A11.

[0023] On the other hand, the terminal node D132 generates a random number key 16 by superimposing, for example, the multiple divided data 18 quantum key distributed from the multiple intermediate nodes 133 using an exclusive OR, and distributes the generated random number key 16 to the user B12. The random number key 16 generated in the terminal node C131 and the random number key 16 generated in the terminal node D132 are the same. In other words, the random number key 16 distributed to the user A11 and the user B is the random number key 16 shared between the terminal node C131 and the terminal node D132.

[0024] The intermediate node 133 distributes the quantum key of the divided data 18, which has been quantum key distributed from the terminal node C131 or another intermediate node 133, to the next intermediate node 133 or the terminal node D132 along the distribution route. Note that when forming a route, data may be relayed in the reverse direction from the terminal node D132 side to the terminal node C131 side as appropriate.

[0025] FIG. 2 is a block diagram showing an example of a functional configuration in which nodes in the quantum cryptography communication network 13 play the role of terminal nodes (131, 132).

[0026] The terminal nodes 131 and 132 each include a data processing function unit including a receiving unit 201, a random key split data generating unit 202, an encryption key (random key) generating unit 203, a quantum key receiving unit 204, a quantum key transmitting unit 205, and a transmitting unit 206, as well as a storage function unit including a memory unit 207. The data processing function unit may be realized by a CPU (Central Processing Unit) executing a program, or may be realized as hardware such as an electrical circuit. The storage function unit may be implemented using various storage devices such as an HDD (Hard Disk Drive) or an SSD (Solid State Drive).

[0027] The receiving unit 201 receives a request from a user (user A11, user B12) for the random number key 16. As described above, the request for the random number key 16 is transmitted, for example, via a server that centrally manages the encryption key provision service.

[0028] The random number key split data generation unit 202 generates a plurality of split data 18, which are data essential for generating the random number key 16 (in the case of the terminal node C131). As described above, instead of generating random numbers as the split data 18, a quantum key generated by a quantum key distribution function may be used as the split data 18. In other words, the random number key split data generation unit 202 may be implemented by the quantum key distribution function.

[0029] The encryption key (random number key) generation unit 203 generates a random number key 16 by combining multiple split data 18 (in the case of terminal node C131) generated by the random number key split data generation unit 202 or multiple split data 18 (in the case of terminal node D132) received by the quantum key receiving unit 204 using an exclusive OR or the like.

[0030] The quantum key receiving unit 204 receives a plurality of divided data 18 from a plurality of intermediate nodes 133 that each form a different route (in the case of terminal node D132). On the other hand, the quantum key transmitting unit 205 transfers (quantum key distribution) the plurality of divided data 18 generated by the random number key split data generating unit 202 to a plurality of intermediate nodes 133 that each form a different route (in the case of terminal node C131). The quantum key receiving unit 204 and the quantum key transmitting unit 205 are responsible for the quantum key distribution function.

[0031] The transmitting unit 206 delivers the random key 16 generated by the encryption key generating unit 203 in response to a request for the random key 16 from a user (user A11, user B12) received by the receiving unit 201. It is assumed that some kind of confidentiality protection measures are taken for communications between the terminal node C131 or terminal node D132 and the user A11 or user B12. Here, the method is not important.

[0032] The storage unit 207 stores various data including the divided data 18 and the random number key 16. The storage unit 207 also stores an encryption key for performing encrypted communication with the intermediate node 133. Note that this various data is deleted as appropriate.

[0033] FIG. 3 is a block diagram showing an example of a functional configuration in which a node in the quantum cryptography communication network 13 plays the role of the intermediate node 133. As shown in FIG.

[0034] The intermediate node 133 includes data processing function units, namely, a receiving unit 301, a random number generating unit 302, a quantum key receiving unit 303, a quantum key transmitting unit 304, and a transmitting unit 305, and a storage function unit, namely, a memory unit 306. The data processing function unit is responsible for the quantum key distribution function and may be realized by a CPU executing a program, or may be realized as hardware, such as an electrical circuit. The storage function unit may be implemented using various storage devices, such as an HDD or SSD.

[0035] The receiver 301 receives a request for quantum key distribution from the terminal node C131 or another intermediate node 133. The random number generator 302 generates a random number (encryption key for the quantum cryptography communication network) to be used for quantum key distribution. The quantum key receiver 303 receives the divided data 18 from another intermediate node 133. The quantum key transmitter 304 distributes the quantum key of the divided data 18 received by the quantum key receiver 303 to the intermediate node 133 or the terminal node D132. The transmitter 305 returns information on whether or not the request for quantum key distribution received by the receiver 301 can be accommodated. The memory unit 306 stores various data including the divided data 18 and random numbers. Note that this various data is erased as appropriate.

[0036] 4 is a sequence chart showing the processing steps of the encrypted communication method executed by the encrypted communication system of Embodiment 1. As an example, it is assumed that three pieces of divided data 18 are generated and delivered via three different routes.

[0037] The user A11 requests the terminal node C131 for the random number key 16, and the terminal node C131 receives this request (S1). Note that this request may not be directly exchanged between the user A11 and the terminal node C131, but may be exchanged via a server that centrally manages the provision service of the random number key 16.

[0038] The terminal node C131 generates a first random key [1] (divided data 18) and distributes the quantum key to the first intermediate node 133 of the root 1, and the first intermediate node 133 of the root 1 receives this random key [1] (S2). Note that the random key may be generated by a quantum key distribution function.

[0039] The first intermediate node 133 in route 1 quantum key distributes the random key [1] to the second intermediate node 133, and then repeats quantum key distribution of this random key [1] up to the Nth intermediate node 133 (S3).

[0040] The Nth intermediate node 133 of the route 1 quantum key distributes the random key [1] to the terminal node 132 (S4).

[0041] The second and third random number keys [2,3] are generated at the terminal node C131, just like the first random number key [1], and then quantum key distributed to the terminal node D132 via N intermediate nodes 133 on routes 2 and 3 (S5-7, S8-10).

[0042] The terminal node C131 combines the three generated random number keys [1, 2, 3] (divided data 18) using exclusive OR to generate the random number key 16 (S11). Note that the combination may be performed using any of a number of other methods, such as addition or subtraction, instead of or in addition to exclusive OR.

[0043] In response to the request for the random number key 16 in step S1, the terminal node C131 delivers the generated random number key 16 to the user A11 (S12).

[0044] User A11 receives the random number key 16 from terminal node C131 and uses the random number key 16 to encrypt plaintext data 15 with the Vernam cipher to generate ciphertext data 17. User A11 then delivers the ciphertext data 17, which is the encrypted plaintext data 15, to user B12 via the Internet network 14 (S13).

[0045] Meanwhile, the terminal node D132 combines the three random number keys [1, 2, 3] (divided data 18) delivered in steps S4, S7, and S10, respectively, using the same method as in step S11, to generate a random number key 16 (S14). The terminal node D132 delivers the generated random number key 16 to user B12 (S15).

[0046] The user B12 decrypts the encrypted data 17 delivered from the user A11 using the random number key 16 delivered from the leaf node D132, and obtains the plaintext data 15 (S16).

[0047] FIG. 5 is a diagram showing an example of a method for generating the random number key 16 in the leaf node C131 and an example of encryption of the plaintext data 15 in the user A11.

[0048] Here, the three generated random number keys (divided data 18) are called random number key [1], random number key [2], and random number key [3], respectively. Random key 16 is obtained by calculating random key [1] XOR random key [2] XOR random key [3].

[0049] On the other hand, for user A11, The random key 16 is XORed with the plaintext data 15 to obtain the encrypted data 17.

[0050] In this way, the encrypted communication system of the first embodiment generates the random key 16 by superimposing the Vernam cipher of multiple divided data 18, so even if an unauthorized eavesdropper infiltrates one intermediate node 133 within a certain route and steals part of the divided data 18, he or she will not be able to decrypt even part of the encrypted data 17 communicated between user A11 and user B12 over the Internet network 14.

[0051] As described above, in the cryptographic communication system of the first embodiment, data essential for generating the random key 16 is sent and received across multiple routes between the source node and the destination node, assuming, for example, the superposition of the Vernam cipher, and the random key 16 (common key) is shared. Therefore, even if an unauthorized eavesdropper infiltrates an intermediate node on a route and steals part of the data essential for generating the random key, the unauthorized eavesdropper will not be able to decrypt the random key, and the security of user communications can be maintained.

[0052] (Second embodiment) Next, a second embodiment will be described.

[0053] In the cryptographic communication system of the second embodiment, data required for generating a random key is sent and received between a source node and a destination node by dividing the data into multiple routes using, for example, a secret sharing scheme, and the random key (an encryption key for the Internet network) is shared. In the cryptographic communication system of the second embodiment, the shared encryption key is delivered from the two terminal nodes (terminal node C131 and terminal node D132) to user A11 and user B12 who are performing cryptographic communication.

[0054] This means that even if an unauthorized eavesdropper infiltrates an intermediate node on a route and steals part of the data essential for generating the random key 16, the unauthorized eavesdropper will not be able to decrypt the random key 16, thereby maintaining the security of user communications.

[0055] 6 is a block diagram showing an example of the configuration of an encrypted communication system according to the second embodiment. Similar to the encrypted communication system according to the first embodiment described above, the encrypted communication system according to the second embodiment distributes a random number key 16 for encrypted communication to users A11 and B12 who transmit and receive encrypted data 17 via an Internet network 14. In other words, the encrypted communication system according to the second embodiment is also a platform that provides a service for distributing encryption keys to users who perform encrypted communication. The encrypted communication system according to the second embodiment differs from the encrypted communication system according to the first embodiment in that the divided data 18 (see FIG. 1 ) of the encrypted communication system according to the first embodiment is replaced with shared data 19.

[0056] In the cryptographic communication system of the second embodiment, when the terminal node C131 receives a request for the random key 16 from the user A11, the terminal node C131 generates multiple pieces of shared data 19 as data required for generating the random key 16. Note that the shared data 19 are not necessarily generated by sharing the random key 16 using a secret sharing scheme, but are simply random numbers, and for convenience, the simple random numbers can be considered as data generated by sharing the random key 16 using a secret sharing scheme. Therefore, like the divided data 18 in the cryptographic communication system of the first embodiment, the shared data 19 may be generated by reusing a quantum key generated by a quantum key distribution function. Also, like the cryptographic communication system of the first embodiment, the shared data 19 may be generated continuously while the user A11 is performing cryptographic communication.

[0057] The terminal node C131 transfers the multiple shared data 19 to multiple neighboring intermediate nodes 133 on the quantum cryptography communication network 13, each of which forms a different route, with the terminal node D132 as the intended destination (quantum key distribution). Even if the shared data 19 is actually just random numbers that have not been secretly shared, the terminal node C131 performs a restoration process using a secret sharing method that uses an exclusive OR or the like to obtain the random number key 16. For simplicity of explanation, the random number key 16 is assumed to be data after the restoration process, but the random number key 16 may also be data that has been processed in some way on the data after the restoration process. The terminal node C131 delivers the generated random number key 16 to the user A11.

[0058] Meanwhile, the terminal node D132 also performs a recovery process by a secret sharing method using an exclusive OR or the like, using the multiple pieces of shared data 19 distributed by the quantum keys from the multiple intermediate nodes 133. The terminal node D132 generates a random number key 16 based on the data obtained by this recovery process, and distributes the generated random number key 16 to the user B12. The random number key 16 generated by the terminal node C131 and the random number key 16 generated by the terminal node D132 are the same. In other words, the random number key 16 distributed to the user A11 and the user B is the random number key 16 shared between the terminal node C131 and the terminal node D132.

[0059] FIG. 7 is a block diagram showing an example of a functional configuration in the case where nodes in the quantum cryptography communication network 13 play the role of terminal nodes (131, 132) in the cryptographic communication system of the second embodiment.

[0060] The terminal nodes 131 and 132 each include data processing function units including a receiving unit 701, a random number key shared data generating unit 702, an encryption key generating unit 703, a quantum key receiving unit 704, a quantum key transmitting unit 705, and a transmitting unit 706, and a storage function unit including a memory unit 707. Of these, the receiving unit 701, the quantum key receiving unit 704, the quantum key transmitting unit 705, the transmitting unit 706, and the memory unit 707 correspond to the receiving unit 201, the quantum key receiving unit 204, the quantum key transmitting unit 205, the transmitting unit 206, and the memory unit 207 of the terminal nodes C131 and D132 of the first embodiment (see FIG. 2). The random number key shared data generating unit 702 essentially corresponds to the random number key split data generating unit 202 of the terminal node 131 of the first embodiment, with its name changed. In addition, the product of the random number key split data generation unit 202 of the terminal node 131 in the first embodiment is called split data 18, while the product of the random number key shared data generation unit 702 is called shared data 19. On the other hand, although the encryption key generation unit 703 has the same name as the encryption key generation unit 203 of the terminal nodes 131 and 132 in the first embodiment, its substance is different. Therefore, only the encryption key generation unit 703 will be described here, and descriptions of the others will be omitted.

[0061] The encryption key generation unit 703 performs a recovery process by a secret sharing scheme using an exclusive OR or the like, using the multiple pieces of shared data 19 generated by the random key shared data generation unit 702 (in the case of terminal node C131) or the multiple pieces of shared data 19 received by the quantum key receiving unit 204 (in the case of terminal node D132). Then, the encryption key generation unit 703 generates a random key 16 based on the data obtained by this recovery process. The generation of the random key 16 by this secret sharing scheme will be described in detail later.

[0062] In the cryptographic communication system of the second embodiment, the functional configuration when a node in the quantum cryptographic communication network 13 plays the role of the intermediate node 133 is the same as that of the cryptographic communication system of the first embodiment, so a description thereof will be omitted.

[0063] 8 is a sequence chart showing the processing steps of the encrypted communication method executed by the encrypted communication system of the first embodiment. As an example, it is assumed that three pieces of shared data 19 are generated and delivered via three different routes.

[0064] The user A11 requests the terminal node C131 for the random number key 16, and the terminal node C131 receives this request (S1). Note that this request may not be directly exchanged between the user A11 and the terminal node C131, but may be exchanged via a server that centrally manages the provision service of the random number key 16.

[0065] The terminal node C131 generates a first random key [1] (distributed data 19) and distributes the quantum key to the first intermediate node 133 of the root 1, and the first intermediate node 133 of the root 1 receives the random key [1] (S2). Note that the random key may be generated by a quantum key distribution function.

[0066] The first intermediate node 133 in route 1 quantum key distributes the random key [1] to the second intermediate node 133, and then repeats quantum key distribution of this random key [1] up to the Nth intermediate node 133 (S3).

[0067] The Nth intermediate node 133 of the route 1 quantum key distributes the random key [1] to the terminal node 132 (S4).

[0068] The second and third random number keys [2,3] are generated at the terminal node C131, just like the first random number key [1], and then quantum key distributed to the terminal node D132 via N intermediate nodes 133 on routes 2 and 3 (S5-7, S8-10).

[0069] The terminal node C131 uses the generated three random number keys [1, 2, 3] (shared data 19) to perform a restoration process using a secret sharing scheme that uses exclusive OR or the like. The terminal node C131 generates a random number key 16 based on the data obtained by this restoration (S11) and delivers the generated random number key 16 to the user A11 (S12). Generating the random number key 16 based on the data obtained by the restoration process using the secret sharing scheme means removing dummy information (such as disposable physical random numbers) that was embedded to conceal the secret information (random number key 16).

[0070] User A11 receives the random number key 16 from terminal node C131 and uses the random number key 16 to encrypt plaintext data 15 with the Vernam cipher to generate ciphertext data 17. User A11 then delivers the ciphertext data 17, which is the encrypted plaintext data 15, to user B12 via the Internet network 14 (S13).

[0071] Meanwhile, the terminal node D132 executes a restoration process by a secret sharing scheme using an exclusive OR or the like, using the three random number keys [1, 2, 3] (shared data 19) delivered in steps S4, S7, and S10, respectively. The terminal node D132 generates a random number key 16 based on the data obtained by this restoration (S14), and delivers the generated random number key 16 to the user B12 (S15).

[0072] The user B12 decrypts the encrypted data 17 delivered from the user A11 using the random number key 16 delivered from the leaf node D132, and obtains the plaintext data 15 (S16).

[0073] Here, a method for generating the random number key 16 by the terminal nodes C131 and D132 in the encrypted communication system of the second embodiment will be described with reference to FIGS.

[0074] FIG. 9 is a first diagram showing an example of a method for generating a random key 16 by a terminal node C131 in an encryption communication system according to the second embodiment. Here, an example is given in which the random key 16 is generated by ramp secret sharing with a share number of 3 and a threshold of 3 (in this example, ramp secret sharing with thresholds K=3, L=2, and N=3). With this ramp secret sharing, even if one of the three pieces of shared data 19 is intercepted, it cannot be restored. Here, it is assumed that the ratio of random numbers (dummy data, i.e., disposable physical random numbers) to plaintext (here, the common key, i.e., the physical random numbers used as the random key 16) is 1:2. The ramp type allows the ratio of random numbers to plaintext to be changed, and when the ratio of random numbers to plaintext is (threshold - 1):1, it is particularly called perfect secret sharing.

[0075] First, assume that the terminal node C131 has a physical random number. Then, assume that the terminal node C131 considers the physical random number as source data and performs a sharing process using ramp secret sharing with a threshold of 3. The terminal node C131 then considers the randomly generated random numbers (random key [1], random key [2], random key [3]) to be obtained through this sharing. In other words, the terminal node C131 does not actually generate the shared data 19 using secret sharing. Therefore, the shared data 19 can be generated by reusing a quantum key generated by a quantum key distribution function, which improves the efficiency of physical random number generation. In this way, the present invention has features not found in data transfer using simple secret sharing. It is also possible to generate distributed data 19 by distributing the randomly generated random numbers (random number key [1], random number key [2], random number key [3]) using a secret sharing method. However, in this case, the terminal node C131 must generate an additional physical random number to serve as the original data in addition to the quantum key (physical random number) generated by the quantum key distribution function, which reduces the efficiency of physical random number generation.

[0076] To explain the sharing process of ramp secret sharing with threshold 3 in more detail, first, the original data is sorted according to the threshold number. For example, if the original data is "1 to 15," it is sorted into "1, 4, 7, 10, 13," "2, 5, 8, 11, 14," and "3, 6, 9, 12, 15." In Figure 9, each group after sorting is represented by a row.

[0077] Next, to generate the three shared data, the second row of shared (2) is shifted by one column, and the third row of shared (3) is shifted by one column, and then convolution is performed, for example, using exclusive OR, on each of shared (1) to shared (3). Note that this convolution is not limited to exclusive OR, and may be a calculation using a polynomial, or addition or subtraction, etc.

[0078] When the terminal node C131 generates a random number, it regards this random number as shared data obtained by the above procedure (shared processing using ramp secret sharing with threshold 3). In other words, the terminal node C131 generates multiple random number sequences (random number key [1], random number key [2], random number key [3]) and regards each random number sequence as shared data. The terminal node C131 distributes these random numbers (shared data 19) to different routes for each random number sequence and transfers them to the terminal node D132.

[0079] FIG. 10 is a second diagram showing an example of a method for generating the random number key 16 by the terminal node C131 in the encrypted communication system of the second embodiment.

[0080] The terminal node C131 uses three pieces of shared data 19 (actually, they are simply random numbers) to perform a recovery process using ramp secret sharing with three shares and a threshold of three (in this example, ramp secret sharing with thresholds K=3, L=2, and N=3 shares) ("Calculation" in Figure 10). This recovery process yields the original data "1 to 15" of the hypothetical physical random numbers mentioned above.

[0081] Note that if the restoration process is performed in this way without performing the shared process using the secret sharing method, the data (original data) of some layers (rows) of some of the shared data will be inconsistent (when all of the shared data is restored to the original data, the original data will not match for some of the shared data). In order to prevent inconsistencies from occurring, it is sufficient to consider that some of the shared data has been exclusive-ORed with another random number (x1 to x5). This can be considered to have been shared in advance between terminal node C131 and terminal node D132. Note that if it is determined in advance or dynamically between terminal node C131 and terminal node D132 which shared data to use to generate the original data, the original data generated by at least terminal node C131 and terminal node D132 will match, so this inconsistency will not be a problem. Note that although there are some inconsistencies, the restoration process is performed using the secret sharing method by considering the physical random numbers (random number key [1], random number key [2], random number key [3]) as shared data, so security is sufficiently ensured.

[0082] Here, it is assumed that the ratio of random numbers to plain text is "1:2", so the terminal node C131 removes, for example, "1, 4, 7, 10, 13" (one predetermined row) from the restored original data "1 to 15" as dummy data (disposable physical random numbers), and extracts "2, 3, 5, 6, 8, 9, 11, 12, 14, 15" (two predetermined rows), thereby generating the random number key 16 to be delivered to user A11.

[0083] In the case of perfect secret sharing, the ratio of random numbers to plain text is "threshold - 1:1" ("2:1"), so the terminal node C131 generates the random number key 16 to be distributed to user A11 by removing, for example, "1, 2, 4, 5, 7, 8, 10, 11, 13, 14" (two predetermined rows) as dummy data (disposable physical random numbers) and extracting "3, 6, 9, 12, 15" (one predetermined row).

[0084] Meanwhile, the terminal node D132, which receives the shared data 19 from the terminal node C131, also performs the same calculation as the terminal node C131 to generate the random number key 16 to be distributed to the user B12. The random number key 16 generated by the terminal node C131 and the random number key 16 generated by the terminal node D132 are the same. In other words, the random number key 16 distributed to the user A11 and the user B is the random number key 16 shared between the terminal node C131 and the terminal node D132.

[0085] In the cryptographic communication system of the first embodiment, n random numbers (divided data 18) are used to generate n×(1 / 3) random number keys 16, whereas in the cryptographic communication system of the second embodiment, when the ratio of random numbers to plaintext is "1:2", for example, n random numbers (shared data 19) are used to generate n×(2 / 3) random number keys 16, thereby reducing the consumption of random numbers. Therefore, in this example, the communication rate is also doubled. Note that in the case of perfect secret sharing where the ratio of random numbers to plaintext is "threshold - 1:1", n×(1 / 3) random number keys 16 are generated. In other words, the consumption of random numbers is the same as that of superposition in the cryptographic communication system of the first embodiment.

[0086] FIG. 11 is a diagram showing an example of encryption of plaintext data 15 by user A11. As in the case of the encrypted communication system of the first embodiment, in the encrypted communication system of the second embodiment, the user A11 The random key 16 is XORed with the plaintext data 15 to obtain the encrypted data 17.

[0087] In this way, the cryptographic communication system of the second embodiment distributes multiple pieces of shared data 19 (which are actually just random numbers) that are considered to have been shared using a ramp secret sharing scheme, so that even if an unauthorized eavesdropper infiltrates an intermediate node in a certain route and steals part of the shared data 19, the information on the random number key 16 will not be leaked. Therefore, even a part of the encrypted data 17 communicated between user A11 and user B12 over the Internet 14 cannot be decrypted.

[0088] As described above, in the encrypted communication system of the second embodiment, the data required for generating the random key 16 is distributed to multiple routes and transmitted between the source node and the destination node, and the random key 16 (common key) is shared, based on the secret sharing scheme. Even if an unauthorized eavesdropper intrudes into an intermediate node on a route and steals some of the data required for generating the encryption key, the unauthorized eavesdropper cannot decrypt the encryption key, thereby maintaining the security of user communications. Here, the number of shares is the same as the threshold, 3, but if the number of shares is set to number of shares = threshold + α (α = 1, 2, 3, ...), the random key 16 can be generated even if (number of shares - threshold) pieces of shared data are lost. Therefore, even if some intermediate nodes 133 malfunction, the terminal node C 131 and the terminal node D 132 can share the random key 16 without any problems.

[0089] In the above explanation, assuming the existence of some original data, recovery is performed using ramp secret sharing with a share count of 3 and a threshold of 3. If the ratio of random numbers to plaintext is 1:2, one row (out of three rows) of the recovered data is removed as random numbers (dummy data), and two rows of data are used as the random key 16. If information-theoretic security is not ensured, all of the recovered data can be used as plaintext (random key 16), or only part of one row can be used as random numbers. Even in this case, information-theoretic security cannot be ensured, but the number of combinations of operators required to obtain the original data is enormous, and the security of the user's encrypted communications can be sufficiently ensured. Furthermore, in this case, the consumption of random numbers can be significantly reduced. Therefore, the transfer rate also improves accordingly.

[0090] When the threshold value is set to 2, the only way to ensure information-theoretic security is to set the ratio of random numbers to plaintext at 1:1. However, as mentioned above, if information-theoretic security is not ensured, all of the data obtained by the reconstruction can be used as plaintext, or only part of one line (out of two lines) can be used as random numbers. Even in this case, although information-theoretic security cannot be ensured, the number of combinations of operators required to obtain the original data is enormous, and the security of the user's encrypted communication can be sufficiently ensured. Therefore, the consumption of random numbers can be significantly reduced. Note that, for simplicity's sake, the secret sharing schemes shown in Figures 9 and 10 have been used. However, the secret sharing schemes that can be used are not limited to these. For example, other secret sharing schemes using exclusive OR or polynomials can also be used.

[0091] 12 and 13, a method for generating a random number key 16 by secret sharing with a threshold value of 2 will be described. Fig. 12 is a first diagram showing an example of a method for generating a random number key 16 by secret sharing with a threshold value of 2 and a share number of 3. First, it is assumed that the terminal node C131 has a certain physical random number. It is also assumed that the terminal node C131 considers this as original data and performs shared processing using a secret sharing scheme with a threshold value of 2. The terminal node C131 considers the randomly generated random numbers (random number key [1], random number key [2], random number key [3]) to be obtained by this shared processing. In other words, as described above, the terminal node C131 does not actually generate shared data 19 using secret sharing. In this way, the present invention has a feature not found in data transfer using simple secret sharing. As described above, it is possible to actually perform secret sharing processing here, but in that case, the efficiency of physical random number generation will decrease.

[0092] To explain secret sharing with threshold 2 in more detail, first, the original data is sorted into the threshold number. For example, if the original data is "1 to 14," it is sorted into "1, 3, 5, 7, 9, 11, 13" and "2, 4, 6, 8, 10, 12, 14." In Figure 12, each group after sorting is represented by a row.

[0093] Next, to generate the three shared data, the second row of share (2) is shifted by one column, and the second row of share (3) is shifted by two columns, and then convolution is performed, for example, using exclusive OR, on each of share (1) to share (3). Note that this convolution is not limited to exclusive OR, and may be a calculation using a polynomial, or addition or subtraction, etc.

[0094] When the terminal node C131 generates a random number, it considers this random number to be the shared data obtained by the above procedure (secret sharing with threshold 2). The terminal node C131 distributes this random number (shared data 19) to each random number sequence (random number key [1], random number key [2], random number key [3]) and transfers them to the terminal node D132.

[0095] FIG. 13 is a second diagram showing an example of a method for generating (restoring) the random number key 16 by secret sharing with a threshold value of 2. In FIG.

[0096] The terminal node C131 uses three pieces of shared data 19 (which are actually just random numbers) to perform secret sharing reconstruction with a share number of 3 and a threshold value of 2 ("Calculation" in Figure 13). This reconstruction yields the original data "1 to 14" of the hypothetical physical random numbers mentioned above.

[0097] In the case of ramp secret sharing with a threshold of 2 and a number of shares of 2, no inconsistency occurs during recovery. However, in the case of secret sharing with a threshold of 2 and a number of shares of 2+α (α=1, 2, 3, ...), data in some layers of some shared data will be inconsistent upon recovery, just as in the case of ramp secret sharing with a number of shares of 3 and a threshold of 3 mentioned above. Therefore, just as in the case of ramp secret sharing with a number of shares of 3 and a threshold of 3 mentioned above, we consider that another pre-shared random number is superimposed. Even when the random key 16 is generated using secret sharing with a threshold value of 2, the encrypted communication system of the second embodiment distributes multiple pieces of shared data 19 (which are actually just random numbers) that are considered to have been shared using secret sharing. Even if an unauthorized eavesdropper intrudes into an intermediate node in a certain route and steals part of the shared data 19, he or she cannot decrypt even part of the encrypted data 17 communicated between user A11 and user B12 over the Internet 14. Furthermore, since the threshold value is 2 and the number of shares is 3 in this example, even if one piece of shared data (=1 share minus the threshold value) is lost, the random key 16 can still be generated. Therefore, even if a malfunction occurs in one route of the intermediate node 133, the terminal node C131 and the terminal node D132 can share the random key 16 without any problems. Note that, for simplicity's sake, the secret sharing schemes shown in FIGS. 12 and 13 have been used for the explanation. However, the secret sharing schemes that can be used are not limited to these. For example, other secret sharing schemes using exclusive OR or polynomials can also be used.

[0098] (Root formation[1]) In the encrypted communication system of the first embodiment, multiple routes for transmitting and receiving the divided data 18 are formed between the terminal node C131 and the terminal node 132. In the encrypted communication system of the second embodiment, multiple routes for transmitting and receiving the shared data 19 are formed between the terminal node C131 and the terminal node 132.

[0099] 14, a first example of forming a plurality of routes between terminal node C131 and terminal node D132 on the quantum cryptography communication network 13 will be described. The first example is a so-called dynamic link in which each node in the quantum cryptography communication network 13 operates autonomously to generate a plurality of routes. According to route search using a dynamic link, if a failure occurs at the intermediate node 133 during communication between the terminal nodes 131 and 132, it becomes possible to select a detour route for communication that avoids the failed node.

[0100] Terminal node C131 requests a link to terminal node D132 from the first intermediate node of route 1 (S1). The first intermediate node of route 1 searches for a route among adjacent intermediate nodes, determines the second intermediate node of route 1, and requests a link (S2). When searching for a route, if the destination terminal node D132 is adjacent, it requests a link from terminal node D132. Route search and linking are repeated from the second node onwards up to the Nth node, until a link can be requested from the destination terminal node D132 (S3 to S4). Upon receiving a link request from intermediate node 133, terminal node D132 transmits a link completion notification to terminal node C131 (S5).

[0101] The terminal node C131 requests the first intermediate node of Route 2 for a link to the terminal node D132, and performs the same process as Route 1 (S6 to S10). This process is repeated for the number of divided data 16 of the random number key or the number of shared data 18 of the random number key, and the delivery route for all data is determined.

[0102] As a result, a desired number of routes between the terminal node C 131 and the terminal node D 132 are formed on the quantum cryptography communication network 13. As described above, according to the route search using dynamic links, if a failure occurs at the intermediate node 133 during communication between the terminal nodes 131 and 132, it becomes possible to select a detour route for communication that avoids the failed node.

[0103] Note that, when each intermediate node 133 receives a connection (link) request from a certain intermediate node 133 that specifies the terminal node D132 as the destination, and then receives another connection (link) request from another intermediate node 133 that also specifies the terminal node D132 as the destination, it is preferable for the intermediate node 133 to reject the request from the other intermediate node 133. This makes it possible to prevent one intermediate node 133 from being present on multiple routes. In other words, it is possible to prevent multiple divided data 18 or distributed data 19 from being stolen by an attack on one intermediate node 133.

[0104] (Root formation[2]) Next, a second example will be described in which multiple routes between terminal node C131 and terminal node D132 are formed on the quantum cryptography communication network 13. The second example is a so-called static link in which multiple routes are generated under the management of a route management server that manages routes that can be formed on the quantum cryptography communication network 13. By centrally managing route information on the route management server, it is possible to provide an appropriate route, and also to check for the presence or absence of a faulty node before communication and select a route that does not include the faulty node.

[0105] 15 is a block diagram showing an example of the configuration of a route management server. The route management server includes a receiving unit 1501, an information managing unit 1502, a route calculating unit 1503, a transmitting unit 1504, and a storage unit 1505.

[0106] The receiving unit 1501 receives a link establishment request from the terminal node D 131. In addition, for example, when a node is added or moved on the quantum cryptography communication network 13, the receiving unit 1501 receives a route information update request from a program that provides a GUI (Graphical User Interface) to an operator.

[0107] When the receiving unit 1501 receives a request to update the route information, the information managing unit 1502 updates the route information in the storage unit 1505 .

[0108] When the receiving unit 1501 receives a link establishment request, the route calculation unit 1503 calculates a route based on the route information in the storage unit 1505. The route calculation algorithm may be, for example, a round robin method or a least connection method.

[0109] The transmitting unit 1504 transmits the processing result of the information management unit 1502 to the request source. Also, as the processing result of the route calculation unit 1503, the transmitting unit 1504 transmits link destination instructions to the intermediate node 133 and the terminal nodes 131 and 132, and transmits a link completion notification including information on the connecting node to the request source.

[0110] The storage unit 1505 stores, for example, information on the intermediate node 133 and the terminal nodes 131 and 132 as route information related to all users including the users A11 and B12.

[0111] FIG. 16 is a sequence chart showing a second example of forming a plurality of routes between the terminal node C131 and the terminal node D132 on the quantum cryptography communication network 13. In FIG.

[0112] The terminal node C131 sends a link establishment request including the destination and the number of routes to the route management server (S1). The route management server calculates a route based on the information in the request and the route information, and sends a link completion notification including information on the destination node to the terminal node C131. The route management server also sends link destination instructions for constructing the route to all intermediate nodes 133 and terminal nodes 132 included in the calculated route (S3 to S9).

[0113] The route management server selects a route so that one intermediate node 133 does not exist on multiple routes.

[0114] As a result, the desired number of routes between the terminal node C 131 and the terminal node D 132 are formed on the quantum cryptography communication network 13. As described above, by centrally managing route information on the route management server, it is possible to provide appropriate routes and to check for the presence of faulty nodes before communication and select routes that do not include faulty nodes. Furthermore, it is possible to prevent one intermediate node 133 from being present on multiple routes, which prevents multiple divided data 18 or distributed data 19 from being stolen by an attack on a single intermediate node 133.

[0115] Although several embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included within the scope and spirit of the invention, and are also included in the scope of the invention and its equivalents as defined in the claims. [Explanation of symbols]

[0116] 11...User A, 12...User B, 13...Quantum cryptography communication network, 14...Internet network, 15...Plain text data, 16...Random key, 17...Encrypted data, 18...Divided data, 19...Distributed data, 131...End node C, 132...End node D, 133...Intermediate node, 201...Receiver, 202...Random key split data generator, 203...Encryption key generator, 204...Quantum key receiver, 205...Quantum key transmitter, 206...Transmitter , 207...memory unit, 301...receiving unit, 302...random number generation unit, 303...quantum key receiving unit, 304...quantum key transmitting unit, 305...transmitting unit, 306...memory unit, 701...receiving unit, 702...random number key shared data generation unit, 703...encryption key generation unit, 704...quantum key receiving unit, 705...quantum key transmitting unit, 706...transmitting unit, 1501...receiving unit, 1502...information management unit, 1503...route calculation unit, 1504...transmitting unit, 1505...memory unit.

Claims

1. A system for distributing an encryption key to a first user and a second user who perform encrypted communication, the system comprising a network of a plurality of nodes, wherein the encryption key is shared between a first node that distributes the encryption key to the first user and a second node that distributes the encryption key to the second user, the system comprising: The first node forming n (n>1) systems on the network for a route between the second node and the first node; generating n pieces of first data which are random numbers; Distributing the n pieces of first data to the n routes and transmitting them to the second node; detecting eavesdropping for each path, and generating the encryption key based on second data obtained by restoring the secret sharing scheme in which only the first data of the path in which eavesdropping was not detected is regarded as shared data; The second node receiving the n pieces of first data from the first node via the n routes; Eavesdropping is detected for each path, and the encryption key is generated based on second data obtained by restoring the secret sharing scheme in which only the first data of the path in which eavesdropping has not been detected is regarded as shared data. Cryptographic communication system.

2. 2. The cryptographic communication system according to claim 1, wherein the secret sharing scheme is a perfect secret sharing scheme or a ramp secret sharing scheme.

3. each of the plurality of nodes has a function of searching for a node suitable for forming the route from among all adjacent nodes on the network; the first node requests connections to n neighboring third nodes on the network to form the route when starting distribution of the encryption key; When the second node connects to an adjacent fourth node on the network that requests a connection to form the route, the second node notifies the first node of completion of the formation of the route via the route formed including the fourth node.

3. The cryptographic communication system according to claim 1 or 2.

4. An encryption communication device that distributes an encryption key to one of two users who are performing encryption communication, and shares the encryption key via a network with another encryption communication device that distributes the encryption key to the other user, means for forming n (n>1) systems of paths between the other encryption communication devices on the network; means for generating n pieces of first data which are random numbers; means for distributing the n number of first data to the n routes and transmitting the data to the other encryption communication device; a means for detecting eavesdropping for each path and generating the encryption key based on second data obtained by restoring the secret using a secret sharing scheme in which only the first data on paths where eavesdropping has not been detected are regarded as shared data; An encryption communication device comprising:

5. A cryptographic communication method for a system for distributing a cryptographic key to a first user and a second user who perform cryptographic communication, the system comprising a network of a plurality of nodes, the cryptographic key being shared between a first node that distributes the cryptographic key to the first user and a second node that distributes the cryptographic key to the second user, the method comprising: The first node forming n (n>1) systems on the network for a route between the second node and the first node; generating n pieces of first data which are random numbers; Distributing the n pieces of first data to the n routes and transmitting them to the second node; detecting eavesdropping for each path, and generating the encryption key based on second data obtained by restoring the secret sharing scheme in which only the first data of the path in which eavesdropping was not detected is regarded as shared data; The second node receiving the n pieces of first data from the first node via the n routes; Eavesdropping is detected for each path, and the encryption key is generated based on second data obtained by restoring the secret sharing scheme in which only the first data of the path in which eavesdropping has not been detected is regarded as shared data. Encrypted communication method.

Images