Computing unit, terminal device, network, calculation method, and program

Abstract

The bit length of the given key is compressed to generate a key of equal size to the key used in the cryptographic algorithm. [Solution] The computing device causes the computer to perform the following steps: When the key and bit length of a key used for encryption and integrity assurance, which is generated from a common key assigned for use in communication between a terminal device and a network, is longer than the bit length of an input key used in a predetermined algorithm, a processing step is performed on the bit sequence of the key used for encryption and integrity assurance generated from the common key, by performing different arithmetic operations on each other based on predetermined conditions, to obtain a bit sequence different from the bit sequence of the key used for encryption and integrity assurance generated from the common key; and a hashing step is performed by inputting the bit sequence obtained in the processing step into a predetermined hash function agreed in advance between the terminal device and the network, to obtain a bit sequence having the same bit length as the bit length of the input key.

Description

Technical Field

[0001] The present invention relates to an arithmetic device, a terminal device, a network, an arithmetic method, and a program.

Background Art

[0002] Conventional 3GPP (registered trademark) specifications are formulated on the premise of assigning a 128-bit key to a 128-bit cipher. For example, Non-Patent Document 1 defines the specific specifications of such a technology.

Prior Art Documents

Non-Patent Documents

[0003]

Non-Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] Here, currently, discussions are underway for introducing a 256-bit cipher. When a 256-bit cipher is introduced, it is assumed that 128-bit ciphers and 256-bit ciphers will coexist. In such a case, there is a need to use a 256-bit key with a 128-bit cipher. That is, there is a need to compress the bit length of a given key and generate a key equal to the size of the key used in the cipher algorithm.

[0005] The present invention has been made in consideration of such circumstances, and an object thereof is to provide an arithmetic device, a terminal device, a network, an arithmetic method, and a program capable of compressing the bit length of a given key and generating a key equal to the size of the key used in the cipher algorithm.

Means for Solving the Problems

[0006] (1) One aspect of the present invention is a computer comprising at least a processor and memory, which is an arithmetic device that performs the following steps: a processing step to obtain a bit sequence different from the bit sequence of the key used for encryption and integrity, which is generated from a common key assigned for use in communication between a terminal device and a network, when the key and bit length used for encryption and integrity assurance are longer than the bit length of an input key used in a predetermined algorithm, by performing different arithmetic operations on the bit sequence of the key used for encryption and integrity assurance generated from the common key based on predetermined conditions; and a hashing step to obtain a bit sequence having the same bit length as the bit length of the input key, by inputting the bit sequence obtained in the processing step into a predetermined hash function agreed in advance between the terminal device and the network. (2) In addition, in one aspect of the present invention, in the computing device described in (1) above, the key generated from the common key and used for encryption and integrity assurance is a key in which an encryption key for performing encryption and an authentication key used for integrity assurance are linked. (3) In another aspect of the present invention, in the computing device described in (2) above, the encryption key and the authentication key are generated between the terminal device and the network each time the AKA algorithm for authentication is executed, and the processing step and the hashing step are executed each time the encryption key and the authentication key are generated. (4) In addition, in one aspect of the present invention, in the arithmetic device described in any of (1) to (3) above, the bit sequence obtained by the hashing step is the input key, which is a combination of an encryption key for encryption and an authentication key used to guarantee integrity. (5) In addition, in one aspect of the present invention, in the arithmetic device described in any of (1) to (4) above, the hash function is the same function even if different arithmetic processes are performed in the processing step. (6) In addition, in an embodiment of the present invention, in the arithmetic device described in any of (1) to (5) above, the processing step is to obtain a bit sequence different from the bit sequence of the common key by performing a shift operation on the bit sequence of the key used for encryption and integrity assurance generated from the common key. (7) In addition, in an arithmetic device described in any of (1) to (6) above, the processing step is to obtain a bit sequence different from the bit sequence of the common key by performing an operation using a bit sequence of a key used for encryption and integrity assurance generated from the common key and fixed values ​​that are different from each other based on predetermined conditions. (8) In addition, in an arithmetic device described in any of (1) to (7) above, the processing step is to obtain a bit sequence different from the bit sequence of the common key by concatenating a bit sequence of a key used for encryption and integrity assurance generated from the common key with fixed values ​​that are different from each other based on predetermined conditions. (9) In addition, in one aspect of the present invention, in the arithmetic device described in any of (1) to (8) above, the hashing step is to input the bit sequence obtained by the processing step into the hash function to obtain a bit sequence having the same bit length as the bit length of the input key as a hash value. (10) In addition, in an arithmetic device described in any of (1) to (8) above, the hashing step is to obtain a first hash value by inputting the upper bits of the bit sequence obtained in the processing step into a first hash function agreed in advance between the terminal device and the network, to obtain a second hash value by inputting the lower bits of the bit sequence obtained in the processing step into a second hash function agreed in advance between the terminal device and the network, and to obtain a bit sequence having the same bit length as the bit length of the input key by performing a predetermined operation based on the obtained first hash value and the second hash value. (11) In addition, in one aspect of the present invention, in the arithmetic device described in (10) above, the hashing step is to obtain a bit sequence having the same bit length as the bit length of the input key by performing an exclusive OR operation between the obtained first hash value and the second hash value. (12) In addition, in one aspect of the present invention, in any of the computing devices described in (1) to (11) above, the different computing processes performed by the processing step based on predetermined conditions are different computing processes for each business operator. (13) Another aspect of the present invention is a terminal device equipped with the arithmetic unit described in any of (1) to (12) above. (14) Another aspect of the present invention is a network comprising the computing device described in any of (1) to (12) above. (15) In another aspect of the present invention, in the network described in (14) above, the computing device is provided in at least one of the next generation Node B (gNodeB or gNB) or the AMF (Access and Mobility Management Function). (16) Another aspect of the present invention is a calculation method comprising: a processing step to obtain a bit sequence different from the bit sequence of the key used for encryption and integrity assurance generated from the common key, where the key and bit length used for encryption and integrity assurance are longer than the bit length of the input key used in a predetermined algorithm, by performing different arithmetic operations on the bit sequence of the key used for encryption and integrity assurance generated from the common key based on predetermined conditions; and a hashing step to obtain a bit sequence having the same bit length as the bit length of the input key by inputting the bit sequence obtained in the processing step into a predetermined hash function agreed in advance between the terminal device and the network. (17) Another aspect of the present invention is a program that causes a computer to perform the following steps: when a key generated from a common key assigned for use in communication between a terminal device and a network, and the key and bit length used for encryption and integrity assurance are longer than the bit length of an input key used in a predetermined algorithm, a processing step of obtaining a bit sequence different from the bit sequence of the key used for encryption and integrity assurance generated from the common key by performing different arithmetic operations on the bit sequence of the key used for encryption and integrity assurance generated from the common key based on predetermined conditions; and a hashing step of inputting the bit sequence obtained in the processing step into a predetermined hash function agreed in advance between the terminal device and the network, to obtain a bit sequence having the same bit length as the bit length of the input key. [Effects of the Invention]

[0007] According to the present invention, it is possible to provide a computing device, terminal device, network, computing method, and program that can compress the bit length of a given key and generate a key equal in size to the key used in the cryptographic algorithm. [Brief explanation of the drawing]

[0008] [Figure 1] This figure shows a schematic architecture of a wireless system according to one embodiment. [Figure 2] This is a block diagram schematically representing the wireless system according to this embodiment. [Figure 3] This diagram illustrates the processing of the wireless system according to this embodiment when a 128-bit key is provided and when a 256-bit key is provided. [Figure 4] This sequence diagram shows the timing of the generation of the common key and cryptographic key, as well as the key compression, according to this embodiment. [Figure 5] This is an illustrative diagram illustrating the outline of the first calculation method according to this embodiment. [Figure 6]It is a flowchart showing a series of processes of the first calculation method according to this embodiment. [Figure 7] It is an image diagram for explaining an outline of a modification example of the first calculation method according to this embodiment. [Figure 8] It is a flowchart showing a series of processes of a modification example of the first calculation method according to this embodiment. [Figure 9] It is an image diagram for explaining an outline of a modification example of the second calculation method according to this embodiment. [Figure 10] It is a block diagram showing an example of the internal configuration of a network or a terminal device according to this embodiment.

Mode for Carrying Out the Invention

[0009] [Embodiment] Regarding the arithmetic unit, terminal device, network, arithmetic method, and program according to an aspect of the present invention, preferred embodiments will be described in detail below with reference to the accompanying drawings. Note that the aspects of the present invention are not limited to these embodiments, and also include those with various modifications or improvements. That is, the components described below include those that can be easily assumed by those skilled in the art and substantially identical ones, and the components described below can be combined as appropriate. Also, various omissions, substitutions, or changes of the components can be made without departing from the gist of the present invention. In the following drawings, in order to make each configuration easy to understand, the scale and number, etc. in each structure may be different from those in the actual structure.

[0010] In the following description, for convenience of explanation, terms and names defined in the 3GPP (registered trademark) LTE (3rd Generation Partnership Project Long Term Evolution) standard may be used. However, this embodiment is not limited by such terms and names and is also applicable to systems based on other standards.

[0011] FIG. 1 is a diagram showing a schematic architecture of a wireless system according to an embodiment. The wireless system 1 shown in the figure has a control plane (C-Plane), which is a function for controlling communication, and a user plane (U-Plane), which is a function for realizing user communication, as functional configurations. In the figure, for simplicity of explanation, a basic architecture used in the 5th Generation (5G) mobile communication system is shown. However, the wireless system 1 to which this embodiment is applied is not limited to an example applied to 5G and can be widely applied to other systems.

[0012] In the following description, components other than the UE (User Equipment) may be described as the network. The network includes an access layer and a non-access layer. The access layer includes at least a base station, and the non-access layer includes at least an AMF (Access and Mobility Management Function). As shown in the figure, the UE and the AMF cooperate with each other via the N1 interface. In the following description, the base station and the AMF may be described in a higher-level concept and simply as the network.

[0013] FIG. 2 is a block diagram schematically showing the wireless system according to this embodiment. The figure schematically shows a part of the configuration of the wireless system 1. The wireless system 1 has a network 30 and a terminal device 50. In the figure, as an example, one network and a plurality of terminal devices 50 are described. Specifically, as an example of the plurality of terminal devices 50, terminal devices 50-1, 50-2,..., and terminal device 50-m (m is a natural number of 1 or more) are described.

[0014] Network 30 communicates information with terminal equipment 50. Network 30 includes at least a base station. The base station may include the functions of an O-RU (Radio Unit), O-DU (Distributed Unit), and O-CU (Central Unit), for example, as defined in the O-RAN (Open-RAN) specification.

[0015] Base stations are sometimes also called next generation Node B (gNodeB or gNB), en-gNB, Next Generation-Radio Access Network (NG-RAN) node, eNB, low-power node, CU, DU, RU, gNB-DU, Remote Radio Head (RRH), Integrated Access and Backhaul / Backhauling (IAB) node, etc. A base station is not limited to a single node, but may consist of multiple nodes (for example, a combination of lower-level nodes such as RU or DU and higher-level nodes such as CU).

[0016] The terminal device 50 is used by the user. Specific examples of the terminal device 50 include smartphones, tablet devices, wearable devices, etc. The terminal device 50 may also be referred to as a user device or UE.

[0017] Here, both the network 30 and the terminal device 50 are equipped with an arithmetic unit 10. The arithmetic unit 10 has at least a processor and memory as its hardware configuration. The arithmetic unit 10 may also have its functions realized by having a computer execute a program. The arithmetic unit 10 performs calculations to expand or compress the number of bits of a key used for encryption or decryption. The configurations of the arithmetic units 10 provided by the network 30 and the terminal device 50 may be the same or different. However, at least a part of the configuration of the arithmetic units 10 provided by the network 30 and the terminal device 50 shall be the same.

[0018] Furthermore, the location of the arithmetic unit 10 within the network 30 is arbitrary. For example, the arithmetic unit 10 may be located in the gNodeB or the AMF. Alternatively, the arithmetic unit 10 may be located in at least one of the gNodeB or the AMF within the network 30.

[0019] Figure 3 illustrates the processing in the case where a 128-bit key and a 256-bit key are provided to the wireless system according to this embodiment. Here, the wireless system 1 may be provided with either a 128-bit key or a 256-bit key. Whether to use a 128-bit key or a 256-bit key for encrypted communication is decided at the start of communication. Specifically, the network 30 and the terminal device 50 negotiate at the start of communication to determine the algorithm to be used. If the negotiation results in the use of a 128-bit key and a 128-bit key is provided, it is possible to perform encrypted communication using the 128-bit key as is. However, if a 256-bit key is provided, it is necessary to first compress the 256-bit key to 128 bits and then perform encrypted communication using the compressed 128-bit key.

[0020] Figure 3(A) shows an example where a 128-bit key is provided. In this case, the network 30 and the terminal device 50 can communicate with each other using the 128-bit key in an encrypted manner.

[0021] Figure 3(B) shows an example where a 256-bit key is provided. In this case, both the network 30 and the terminal device 50 are required to compress the 256-bit key to 128 bits. The network 30 and the terminal device 50 then use the compressed key to perform encrypted communication with each other.

[0022] [Key compression method] The following describes a specific example of a key compression method. The key compression method described below is performed by the arithmetic units 10 provided in both the network 30 and the terminal device 50. That is, the key compression method described below is performed separately and independently in both the network 30 and the terminal device 50. While the above example describes a case where a 256-bit key is compressed to 128 bits, the number of bits in the key targeted by the key compression method according to this embodiment is not limited to this example. In the following description, the number of bits in the key will be described in a generalized manner.

[0023] As a premise, assume that a common key K1 is generated between terminal device 50 and network 30 as a key to be used for encryption. The common key K1 can also be described as a key assigned for use in communication between terminal device 50 and network 30. Furthermore, assume that algorithm E is selected as the encryption method to be used between terminal device 50 and network 30. The input key for algorithm E is referred to as input key K2. The input key K2 can also be described as a key used in a given algorithm E. The aforementioned arithmetic unit 10 generates input key K2 by compressing the common key K1. Terminal device 50 and network 30, which communicate with each other, generate the same input key K2 by compressing the same common key K1.

[0024] [Timing of symmetric and cryptographic key generation and key compression] Figure 4 is a sequence diagram showing the timing of the generation of the common key and cryptographic key, and the key compression, according to this embodiment. The timing of the generation of the common key and cryptographic key, and the key compression will be explained with reference to this figure.

[0025] (Step S11) First, the AKA (Authentication Key Agreement) protocol is executed between the terminal device 50 and the network 30. Specific AKA protocols that can be exemplified include 5G-AKA and EAP-AKA.

[0026] (Step S12) When the AKA protocol is executed, the terminal device 50 generates an encryption key CK1 and an authentication key IK1 from the already assigned common key K1. If the common key K1 is 256 bits, then the encryption key CK1 and the authentication key IK1 will each be 256 bits. That is, the key formed by concatenating the encryption key CK1 and the authentication key IK1 will be 512 bits.

[0027] (Step S13) Also, similar to step S12, on the network 30 side, the encryption key CK1 and authentication key IK1 are generated from the already assigned common key K1. Since the common key K1 is agreed upon between the network 30 and the terminal device 50, the encryption key CK1 and authentication key IK1 generated by the terminal device 50 are identical to the encryption key CK1 and authentication key IK1 generated by the network 30.

[0028] (Step S14) Once the encryption key CK1 and authentication key IK1 are generated, the encryption key CK1 and authentication key IK1 are compressed to generate the input key K2. The input key K2 is, for example, a key formed by concatenating the encryption key CK2 and the authentication key IK2, and may be a 256-bit bit sequence formed by concatenating a 128-bit encryption key CK2 and a 128-bit authentication key IK2.

[0029] (Step S15) Also, similar to step S14, the network 30 compresses the encryption key CK1 and authentication key IK1 to generate the input key K2. Since the encryption key CK1 and authentication key IK1 are the same between the network 30 and the terminal device 50, the input key K2 generated by the terminal device 50 and the input key K2 generated by the network 30 are identical to each other.

[0030] [First calculation method] Figure 5 is an illustrative diagram illustrating the outline of the first calculation method according to this embodiment. The outline of the first calculation method will be explained with reference to this figure. The first calculation method comprises an encryption key / authentication key generation step P10, a processing step P11, and a hashing step P12.

[0031] First, in the encryption key / authentication key generation process P10, the encryption key CK1 and authentication key IK1 are generated from the common key K1. The encryption key CK1 is the key used for encryption. The authentication key IK1 is the key used for integrity assurance. A key used for integrity assurance is, for example, an authentication key used to detect data tampering. The encryption key CK1 and authentication key IK1 may be used in conjunction with each other, and together they can be considered the key used for encryption and integrity assurance. In this embodiment, it is assumed that the encryption key CK1 and authentication key IK1 are used in conjunction with each other as the input key K2, but this embodiment is not limited to this example. The encryption key CK1 and authentication key IK1 may be used separately and independently.

[0032] Furthermore, the encryption key and authentication key generation step P10 may be executed in response to the execution of the AKA algorithm for mutual authentication between the terminal device 50 and the network 30. In other words, the encryption key CK1 and authentication key IK1 may be generated each time the AKA algorithm is executed. Moreover, the processing step P11 and the hashing step P12, described later, may be executed each time the AKA algorithm is executed and the encryption key CK1 and authentication key IK1 are generated.

[0033] Next, the generated encryption key CK1 and authentication key IK1 are input to processing step P11. In processing step P11, if the bit length of the bit sequence formed by concatenating the encryption key CK1 and authentication key IK1 (e.g., 512 bits) is longer than the bit length of the input key K2 used in algorithm E (e.g., 256 bits), some arithmetic operation is performed. In processing step P11, some arithmetic operation is performed on the bit sequence formed by concatenating the encryption key CK1 and authentication key IK1 to obtain a bit sequence that is at least different from the bit sequence of the common key K1.

[0034] Here, the calculations performed in processing step P11 are different from each other based on predetermined conditions. These different processes based on predetermined conditions may, for example, be different processes for each business operator, or different processes for each country, region, or organization. More specifically, these different calculations may be different calculations themselves, or different fixed values ​​used in the calculations. In the following explanation, as an example, we will describe the case where the calculations performed in processing step P11 are different for each business operator. A specific example of calculations will be described below.

[0035] (1) For example, as an example of arithmetic processing, processing using shift operations can be illustrated. More specifically, shift operations may include logical shifts, arithmetic shifts, and cyclic shifts. Processing step P11 can also be performed by performing a shift operation on a bit sequence formed by concatenating the encryption key CK1 and the authentication key IK1, thereby obtaining a bit sequence different from the bit sequence formed by concatenating the encryption key CK1 and the authentication key IK1.

[0036] (2) As an example of arithmetic processing, arithmetic processing with fixed values ​​that differ for each business operator can be exemplified. More specifically, arithmetic processing with fixed values ​​may include arithmetic operations and logical operations. The fixed values ​​used in the arithmetic processing may be those that have been assigned to each business operator in advance. Processing step P11 can also be used to obtain a bit sequence different from the bit sequence formed by concatenating the encryption key CK1 and the authentication key IK1, by performing an operation using a bit sequence formed by concatenating the encryption key CK1 and the authentication key IK1, and a fixed value that differs for each business operator.

[0037] (3) As an example of arithmetic processing, a process of concatenating with a fixed value that differs for each business operator can be exemplified. More specifically, the process of concatenating with a fixed value may be a process of concatenating a fixed value, such as 4 bits or 8 bits, that has been pre-assigned to each business operator, to the end or beginning of the bit sequence that concatenates the encryption key CK1 and the authentication key IK1. Processing step P11 can also be used to obtain a bit sequence different from the bit sequence that concatenates the encryption key CK1 and the authentication key IK1 by concatenating the bit sequence that concatenates the encryption key CK1 and the authentication key IK1 with a fixed value that differs for each business operator. Here, the number of bits will increase due to the concatenation. However, it is acceptable if the number of bits increases (or decreases) as a result of the calculation by processing step P11.

[0038] (4) As an example of arithmetic processing, it is conceivable to perform processing that combines multiple processes from (1) to (3) described above. This combined processing may be a combination of at least two of the following: shift operations such as logical shifts, arithmetic shifts, and cyclic shifts; arithmetic operations, logical operations, and concatenation processing with fixed values ​​that differ for each business operator.

[0039] Next, the bit sequence after processing in step P11 (processed bit sequence) is input to the hashing step P12.

[0040] In the hashing step P12, the bit sequence obtained in processing step P11 is input to a predetermined hash function to obtain a bit sequence with the same bit length as the input key K2. The bit sequence obtained in the hashing step P12 can also be described as the input key K2, which is formed by linking the encryption key CK2 used for encryption and the authentication key IK2 used for integrity assurance. Here, the hash function used in the hashing step P12 is a function agreed upon in advance between the terminal device 50 and the network 30. This hash function may be stored in memory units (not shown) of the terminal device 50 and the network 30, respectively.

[0041] Here, it is preferable that the hash function used in the hashing process P12 be the same function even if different arithmetic operations are performed in each processing step. Specifically, it is preferable that the hash function be the same function even if the operators are different. From the viewpoint of ensuring independence, it is preferable that different input keys K2 are generated for each operator, even from the same common key K1. The memory capacity of the hash function used in the hashing process P12 is greater than the memory capacity of the arithmetic method used in the processing step P11. Therefore, if different hash functions are prepared for each operator, the terminal device 50 must store as many hash functions as there are operators, which is a burden on the terminal device 50 (in other words, a large memory area must be secured). According to this embodiment, by using a common hash function for each operator and using different arithmetic methods for each operator, the load on the terminal device 50 can be reduced while ensuring the independence of the input keys K2 (and thus improving security).

[0042] In the first calculation method, the hashing step P12 takes the bit sequence obtained in the processing step P11 as input to a hash function to obtain a hash value, which is the input key K2. In other words, the hashing step P12 also takes the bit sequence obtained in the processing step P11 as input to a hash function to obtain a hash value that has the same bit length as the input key K2.

[0043] Figure 6 is a flowchart showing the sequence of steps in the first calculation method according to this embodiment. The sequence of steps in the calculation method described with reference to Figure 5 will be explained with reference to Figure 6.

[0044] (Step S21) First, triggered by the execution of the AKA protocol, the encryption key CK1 and the authentication key IK1 are generated from the common key K1. This step is the encryption key / authentication key generation process P10 in Figure 5.

[0045] (Step S22) Next, the arithmetic unit 10 compares the bit lengths of the common key K1 and the input key K2. When the bit length of the common key K1 is |K1| and the bit length of the input key K2 is |K2|, if |K1| > |K2| (i.e., Step S22; YES), the arithmetic unit 10 proceeds to Step S23 to generate the input key K2 from the common key K1 and continues the subsequent processing. If |K1| > |K2| is not true (i.e., Step S22; NO), the arithmetic unit 10 does not need to perform key compression processing and terminates the processing.

[0046] (Step S23) Next, the arithmetic unit 10 performs different arithmetic operations on the bit sequence formed by linking the encryption key CK1 and the authentication key IK1, based on predetermined conditions. Specifically, the arithmetic unit 10 performs different arithmetic operations on the bit sequence formed by linking the encryption key CK1 and the authentication key IK1, for each business operator. This step is the processing step P11 in Figure 5.

[0047] (Step S24) Furthermore, the arithmetic unit 10 obtains a hash value by inputting the bit sequence obtained in step S23 into a predetermined hash function. This step is the hashing step P12 in Figure 5. The arithmetic unit 10 can use the obtained hash value as the input key K2.

[0048] [Variations of the first calculation method] Next, a modified version of the first calculation method will be described. In this modified version of the first calculation method, the order of the processing step and the hashing step is reversed. That is, in this modified version of the first calculation method, the hashing step is performed first, followed by the processing step.

[0049] Figure 7 is an illustrative diagram illustrating an overview of a modified example of the first calculation method according to this embodiment. The overview of the modified example of the first calculation method will be explained with reference to this figure. Note that in the explanation of the modified example of the first calculation method, matters that have already been explained may be omitted. The modified example of the first calculation method includes an encryption key / authentication key generation step P20, a hashing step P21, and a processing step P22. The encryption key / authentication key generation step P20 performs the same processing as the encryption key / authentication key generation step P10, so its explanation will be omitted.

[0050] The hashing process P21 is a modified version of the hashing process P12. The hashing process P21 is the same as the hashing process P12 in that it obtains a bit sequence with a predetermined bit length by inputting the input value into a predetermined hash function. The hashing process P21 differs from the hashing process P12 in that the input to the hashing process P21 is a bit sequence formed by concatenating the encryption key CK1 and the authentication key IK1. In the hashing process P21, it is also possible to obtain a bit sequence different from the bit sequence formed by concatenating the encryption key CK1 and the authentication key IK1 by inputting the bit sequence formed by concatenating the encryption key CK1 and the authentication key IK1 into a predetermined hash function.

[0051] Processing step P22 is a modified version of processing step P11. The operations performed in processing step P22 are the same as those performed in processing step P11. Processing step P22 differs from processing step P11, which takes a bit sequence formed by concatenating the encryption key CK1 and the authentication key IK1 as input, in that it takes a hashed bit sequence as input. In processing step P22, it is also possible to obtain a bit sequence with the same bit length as the input key K2 by performing different operations on the bit sequence obtained in the hashing step P21 for each business operator.

[0052] In this modified version of the first calculation method, the bit lengths of the input and output may differ due to processing step P22. For example, if a 256-bit output is desired and processing step P22 concatenates 4-bit bit sequences, the hash value output by the hashing step P21 may be made 252 bits, or the bit length of the bit sequence output from processing step P22 may be adjusted so that it is the same as the bit length of the input key K2.

[0053] Figure 8 is a flowchart showing a series of steps in a modified version of the first calculation method according to this embodiment. The series of steps in the calculation method described with reference to Figure 7 will be explained with reference to Figure 8. Steps S21 and S22 have already been explained with reference to Figure 6, so their explanation will be omitted.

[0054] (Step S31) First, the arithmetic unit 10 obtains a hash value by inputting a bit sequence formed by linking the encryption key CK1 and the authentication key IK1 into a predetermined hash function. This step is the hashing step P21 in Figure 7.

[0055] (Step S32) Next, the arithmetic unit 10 performs different arithmetic operations on the bit sequence obtained in step S31 for each business operator. This step is the processing step P22 in Figure 7. The arithmetic unit 10 can use the bit sequence obtained as a result of the arithmetic operations as the input key K2.

[0056] Here, a hash function has the characteristic that even a slight difference in the input value will result in a significantly different output value. When comparing the first calculation method with a modified version of the first calculation method, the first calculation method performs processing before inputting to the hash function, so it can be said that the first calculation method can generate a completely different input key K2 for each business operator. Therefore, it can also be said that the first calculation method can generate a more secure input key K2.

[0057] It should be noted that the processing step according to this embodiment is not limited to the example where it is performed either before or after the hashing step. The processing step may be performed both before and after the hashing step. In other words, the first calculation method and a modified version of the first calculation method may be used in combination.

[0058] [Second calculation method] Figure 9 is an illustrative diagram illustrating an overview of a modified example of the second calculation method according to this embodiment. The overview of the second calculation method will be explained with reference to this figure. The second calculation method includes an encryption key / authentication key generation step P30, a processing step P31, and a hashing step P33. The hashing step P33 differs from the hashing step P12 in that it uses multiple hash functions. The encryption key / authentication key generation step P30 was explained with reference to Figure 5. It is the same as the encryption key / authentication key generation step P10, so the explanation is omitted. Also, the processing step P31 is the same as the processing step P11 explained with reference to Figure 5, so the explanation is omitted.

[0059] In the hashing process P33, the extraction process P32 is performed first. The extraction process P32 is the process of extracting the upper bit sequence and the lower bit sequence from the bit sequence obtained as a result of the processing in the processing process P31. If the bit sequence obtained as a result of the processing in the processing process P31 is 512 bits, the extraction process P32 extracts the upper 256 bits and the lower 256 bits.

[0060] The extracted upper bit sequence is input to the first hash function 331. The first hash function 331 outputs a first hash value. In the hashing step P33, the first hash value can also be obtained by inputting the upper bits of the bit sequence obtained in processing step P31 to the first hash function 331. Similarly, the extracted lower bit sequence is input to the second hash function 332. The second hash function 332 outputs a second hash value. In the hashing step P33, the second hash value can also be obtained by inputting the lower bits of the bit sequence obtained in processing step P31 to the second hash function 332. Both the first hash function 331 and the second hash function 332 are functions agreed upon in advance between the terminal device 50 and the network 30. These hash functions may be stored in memory units (not shown) of the terminal device 50 and the network 30, respectively.

[0061] Next, a predetermined operation is performed based on the first hash value and the second hash value to obtain a bit sequence with the same bit length as the input key K2. The predetermined operation may be, for example, an exclusive OR operation as shown in the figure. However, this embodiment is not limited to this example, and a bit sequence with the same bit length as the input key K2 may be obtained by other operations based on the first hash value and the second hash value.

[0062] The calculation in the hashing process P33 can be expressed as equation (1) below.

[0063]

number

[0064] [Internal structure] Figure 10 is a block diagram showing an example of the internal configuration of a network or terminal device according to this embodiment. At least some of the functions of the network 30 or terminal device 50 can be realized using a computer. As shown in the figure, the computer is composed of a central processing unit (processor) 901, RAM 902, input / output ports 903, input / output devices 904 and 905, etc., and a bus 906. The computer itself can be realized using existing technology. The central processing unit 901 executes instructions contained in programs read from RAM 902, etc. The central processing unit 901 writes data to RAM 902, reads data from RAM 902, and performs arithmetic and logical operations according to each instruction. RAM 902 stores data and programs. Each element contained in RAM 902 has an address and can be accessed using that address. RAM stands for "Random Access Memory". Input / output ports 903 are ports for the central processing unit 901 to exchange data with external input / output devices, etc. Input / output devices 904 and 905 are input / output devices. Input / output devices 904 and 905 exchange data with the central processing unit 901 via input / output ports 903. Bus 906 is a common communication channel used within the computer. For example, the central processing unit 901 reads and writes data to RAM 902 via bus 906. Also, for example, the central processing unit 901 accesses input / output ports via bus 906. Furthermore, all or part of each functional unit of the network 30 or terminal device 50 may be implemented using hardware such as ASICs, PLDs, or FPGAs. Furthermore, all or part of each functional unit may be implemented by a combination of software and hardware.

[0065] [Summary of Embodiments] According to the embodiment described above, the arithmetic unit 10 causes a computer, which has at least a processor and memory, to perform a processing step and a hashing step. The processing step, when the bit length of the key used for encryption and integrity assurance, which is generated from a common key K1 assigned for communication between the terminal device 50 and the network 30, is longer than the bit length of the input key K2 used in a predetermined algorithm E, performs different arithmetic operations on the bit sequence of the key used for encryption and integrity assurance generated from the common key K1 based on predetermined conditions to obtain a bit sequence different from the bit sequence of the key used for encryption and integrity assurance generated from the common key K1. The hashing step inputs the bit sequence obtained in the processing step into a predetermined hash function agreed upon in advance between the terminal device 50 and the network 30 to obtain a bit sequence having the same bit length as the input key K2. By adopting such a configuration, the bit length of a given key can be compressed, and a key equal in size to the key used in the cryptographic algorithm can be generated.

[0066] Furthermore, the above-described embodiment, for example, by "compressing the bit length of a given key and generating a key equal in size to the key used in the cryptographic algorithm," can contribute to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), "build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0067] Although embodiments of the present invention have been described in detail above with reference to the drawings, the specific configuration is not limited to these embodiments, and design modifications and the like are also included within the scope of the gist of the present invention.

[0068] Alternatively, computer programs for realizing the functions of each of the above-mentioned devices may be recorded on a computer-readable recording medium, and the programs recorded on this recording medium may be loaded into a computer system and executed. Note that the term "computer system" here may include hardware such as an operating system and peripheral devices. Furthermore, "computer-readable recording media" refers to writable non-volatile memory such as flexible disks, magneto-optical disks, ROMs, and flash memory, portable media such as DVDs (Digital Versatile Discs), and storage devices such as hard disks built into computer systems.

[0069] Furthermore, "computer-readable recording media" also includes volatile memory (e.g., DRAM (Dynamic Random Access Memory)) within a computer system that acts as a server or client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line, which retains the program for a certain period of time. In addition, the above program may be transmitted from the computer system that stores the program in a storage device, etc., to another computer system via a transmission medium or by transmission waves within the transmission medium. Here, the "transmission medium" for transmitting the program refers to a medium that has the function of transmitting information, such as a network such as the Internet or a communication line such as a telephone line. Furthermore, the above program may be for the purpose of realizing a part of the above-mentioned functions. Moreover, it may be a so-called differential file (differential program) that can realize the above-mentioned functions in combination with a program already recorded in the computer system. [Explanation of Symbols]

[0070] 1... Wireless system, 10... Processing unit, 30... Network, 50... Terminal device, K1... Common key, E... Algorithm, K2... Input key, CK1, CK2... Cryptographic key, IK1, IK2... Authentication key, P10, P20, P30... Cryptographic key / authentication key generation process, P11, P22, P31... Processing process, P12, P21, P33... Hashing process, P32... Extraction process, 331... First hash function, 332... Second hash function

Claims

1. A computer equipped with at least a processor and memory, A key generated from a common key assigned for use in communication between a terminal device and a network, where the key and bit length used for encryption and integrity assurance are longer than the bit length of the input key used in a predetermined algorithm, a processing step to obtain a bit sequence different from the bit sequence of the key used for encryption and integrity assurance generated from the common key by performing different arithmetic operations on the bit sequence of the key used for encryption and integrity assurance generated from the common key based on predetermined conditions, A hashing step is performed by inputting the bit sequence obtained in the above processing step into a predetermined hash function agreed upon in advance between the terminal device and the network, thereby obtaining a bit sequence having the same bit length as the bit length of the input key. A computing device that performs the execution.

2. A key generated from a shared key and used for encryption and integrity assurance is a key in which an encryption key used for encryption and an authentication key used for integrity assurance are linked together. The computing device according to claim 1.

3. The encryption key and the authentication key are generated between the terminal device and the network each time the AKA algorithm for authentication is executed. The processing step and the hashing step are performed each time the cryptographic key and the authentication key are generated. The arithmetic device according to claim 2.

4. The bit sequence obtained by the hashing process is the input key, which consists of an encryption key for encryption and an authentication key used for ensuring integrity. The computing device according to claim 1.

5. The hash functions are the same function even if different arithmetic operations are performed on each other in the processing step. The computing device according to claim 1.

6. The processing step involves performing a shift operation on the bit sequence of the key used for encryption and integrity assurance, which is generated from the common key, to obtain a bit sequence different from the bit sequence of the common key. The computing device according to claim 1.

7. The processing step involves performing an operation using the bit sequence of the key used for encryption and integrity assurance, which is generated from the common key, and fixed values ​​that are different from each other based on predetermined conditions, thereby obtaining a bit sequence different from the bit sequence of the common key. The computing device according to claim 1.

8. The processing step involves concatenating a bit sequence of a key used for encryption and integrity assurance, generated from the common key, with fixed values ​​that are different from each other based on predetermined conditions, thereby obtaining a bit sequence different from the bit sequence of the common key. The computing device according to claim 1.

9. The hashing step involves inputting the bit sequence obtained in the processing step into the hash function to obtain a hash value, which has a bit sequence with the same bit length as the input key. The computing device according to claim 1.

10. The hashing step described above is: The first hash value is obtained by inputting the upper bits of the bit sequence obtained in the above processing step into a first hash function agreed upon in advance between the terminal device and the network. The lower bits of the bit sequence obtained in the above processing step are input into a second hash function agreed upon in advance between the terminal device and the network to obtain a second hash value. By performing a predetermined operation based on the obtained first hash value and the second hash value, a bit sequence having the same bit length as the input key is obtained. The computing device according to claim 1.

11. The hashing step described above is: By performing an exclusive OR operation between the obtained first hash value and the second hash value, a bit sequence having the same bit length as the input key is obtained. The arithmetic device according to claim 10.

12. The calculation processes performed by the aforementioned processing step, which differ from one another based on predetermined conditions, are calculation processes that differ from one another for each business operator. The computing device according to claim 1.

13. A terminal device comprising the arithmetic unit according to any one of claims 1 to 12.

14. A network comprising the computing device according to any one of claims 1 to 12.

15. The aforementioned computing device is provided in at least one of the next generation Node B (gNodeB or gNB) or AMF (Access and Mobility Management Function), The network according to claim 14.

16. A key generated from a common key assigned for use in communication between a terminal device and a network, where the key and bit length used for encryption and integrity assurance are longer than the bit length of the input key used in a predetermined algorithm, a processing step to obtain a bit sequence different from the bit sequence of the key used for encryption and integrity assurance generated from the common key by performing different arithmetic operations on the bit sequence of the key used for encryption and integrity assurance generated from the common key based on predetermined conditions, A hashing step is performed by inputting the bit sequence obtained in the above processing step into a predetermined hash function agreed upon in advance between the terminal device and the network, thereby obtaining a bit sequence having the same bit length as the bit length of the input key. A method of calculation.

17. On the computer, A key generated from a common key assigned for use in communication between a terminal device and a network, where the key and bit length used for encryption and integrity assurance are longer than the bit length of the input key used in a predetermined algorithm, a processing step of obtaining a bit sequence different from the bit sequence of the key used for encryption and integrity assurance generated from the common key by performing different arithmetic operations on the bit sequence of the key used for encryption and integrity assurance generated from the common key based on predetermined conditions, A hashing step in which the bit sequence obtained in the above processing step is input into a predetermined hash function agreed upon in advance between the terminal device and the network, thereby obtaining a bit sequence having the same bit length as the bit length of the input key. A program that executes the command.

Images