Encryption devices, decryption devices, key management systems

Abstract

The present invention provides an encryption device, a decryption device, and a key management system that enable the recovery of the private key even if one of the IC cards storing the split key is missing. [Solution] The encryption device of the embodiment includes an acquisition unit that acquires a secret key, a division unit that divides the secret key into a plurality of division keys, and an output unit that writes at least two types of division keys from the plurality of division keys to each of a plurality of IC cards in different combinations.

Description

Technical Field

[0001] Embodiments of the present invention relate to an encryption device, a decryption device, and a key management system.

Background Art

[0002] Conventionally, there is a system in which a secret key is divided into a plurality of split keys using a technique such as a secret sharing method and output to an IC (Integrated Circuit) card for each split key. There is also a system in which the secret key is restored by combining the split keys of a plurality of IC cards.

[0003] In the restoration system, since the secret key is restored by combining the split keys of all IC cards, for example, when an IC card is insufficient due to a failure or loss, etc., the secret key cannot be restored. Therefore, when restoring, an IC card that has divided the secret key again is required.

Prior Art Documents

Non-Patent Documents

[0004]

Non-Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] Therefore, the problem that the present invention aims to solve, in view of the above circumstances, is to provide an encryption device, a decryption device, and a key management system that enable the recovery of a secret key even if one of the IC cards storing the split key is missing. [Means for solving the problem]

[0006] The encryption device of this embodiment includes an acquisition unit that acquires a secret key, a division unit that divides the secret key into a plurality of division keys, and an output unit that writes at least two types of division keys from the plurality of division keys to each of a plurality of IC cards in different combinations. [Brief explanation of the drawing]

[0007] [Figure 1] Figure 1 shows an example of the configuration of the key management system according to the embodiment. [Figure 2] Figure 2 is a block diagram showing an example of the functional configuration of the first HSM according to the embodiment. [Figure 3] Figure 3 is a block diagram showing an example of the functional configuration of the second HSM according to the embodiment. [Figure 4] Figure 4 is a block diagram showing an example of the functional configuration of an IC card according to the embodiment. [Figure 5] Figure 5 is an explanatory diagram showing an example of the hardware configuration of the HSM according to the embodiment. [Figure 6] Figure 6 shows an example of the configuration of a split key stored in the IC card of the embodiment. [Figure 7] Figure 7 is a flowchart showing an example of encryption processing by the first HSM of the embodiment. [Figure 8] Figure 8 is a flowchart showing an example of the restoration process by the second HSM of the embodiment. [Figure 9] Figure 9 is a flowchart showing an example of the restoration process by the second HSM in the second embodiment. [Figure 10] Figure 10 shows an example of the configuration of a split key stored in an IC card according to the third embodiment. [Modes for carrying out the invention]

[0008] The encryption device, decryption device, and key management system of this embodiment will be described below with reference to the attached drawings.

[0009] Figure 1 shows an example configuration of the key management system 9 according to the embodiment. As shown in Figure 1, the key management system 9 comprises a first HSM (Hardware Security Module) 1, a second HSM 2, a plurality of IC cards 3, a first user terminal 4, and a second user terminal 5.

[0010] The first HSM1 and the second HSM2 are key management devices, for example, for encryption using a private key as a partition key, and for recovering the private key from a partition key.

[0011] A private key, for example, is the key information used to decrypt encrypted confidential information back into its original plaintext form.

[0012] In this embodiment, when a secret key is recovered using multiple IC cards 3 by the second HSM2, a key management system 9 is described that can recover the secret key even if one of the multiple IC cards 3, which store at least two or more of the multiple partition keys generated by the first HSM1 in different combinations, is missing due to failure, loss, etc.

[0013] The first HSM1 is an example of an encryption device that divides a private key. It generates divided keys by dividing the private key and writes multiple divided keys to multiple corresponding IC cards 3. In other words, the first HSM1 is an example of a transport source that writes different divided keys to multiple IC cards 3 and makes the multiple IC cards 3 transportable to the second HSM2.

[0014] The second HSM2 is an example of a decryption device that restores a secret key from a split key. For example, it reads a plurality of IC cards 3 including the split key and restores the secret key using the plurality of split keys obtained from each of the plurality of IC cards 3. That is, the second HSM2 is an example of a destination that obtains a plurality of IC cards 3 including the split key and restores the secret key using the plurality of IC cards 3.

[0015] The IC card 3 is an example of a plurality of IC devices that store a split key obtained by splitting the secret key by the first HSM1. Details of the configurations of the first HSM1, the second HSM2, and the IC card 3 will be described later.

[0016] The first user terminal 4 is connected to the first HSM1. The first user terminal 4 includes an operation unit 41. The operation unit 41 can control the first HSM1 by being operated by the user.

[0017] The second user terminal 5 is connected to the second HSM2. The second user terminal 5 includes an operation unit 51. The operation unit 51 can control the second HSM2 by being operated by the user.

[0018] Using FIG. 2, a functional configuration example of the first HSM1 of the embodiment will be described. FIG. 2 is a block diagram showing a functional configuration example of the first HSM1 of the embodiment. As shown in FIG. 2, the first HSM1 includes an authentication unit 11, an acquisition unit 12, a splitting unit 13, a restoration unit 14, a restriction unit 15, a storage unit 16, and an output unit 17.

[0019] The authentication unit 11 is an example of a PIN (Personal Identification Number) code authentication unit for the IC card 3. The authentication unit 11, for example, sets (writes) the PIN code input from the first user terminal 4 to the IC card 3.

[0020] The acquisition unit 12 acquires, for example, information input from the first user terminal 4. It also acquires secret information and a secret key. It also acquires a splitting key from the IC card 3. The acquired information, including the secret key, is sent to other functional components such as the splitting unit 13, the restoration unit 14, and the storage unit 16.

[0021] The splitting unit 13 takes the key splitting unit as an example. For instance, it splits the private key acquired by the acquisition unit 12 into multiple split keys. It also receives a key generation request from the first user terminal 4 and generates the key.

[0022] The recovery unit 14, for example, obtains the split key from the IC card 3 containing the split key using the acquisition unit 12, and uses the multiple acquired split keys to recover the private key.

[0023] The restriction unit 15 is an example of a key usage restriction unit. The restriction unit 15 sets an expiration date for the recovery of the private key to be restored. For example, when writing a split key to IC card 3, an expiration date can be set for the recovery of the private key to be restored. Specifically, when restoring a private key while the number of IC cards 3 is less than the total number, the number of times it can be restored and the period during which it can be restored can be set.

[0024] The storage unit 16, for example, is a key database. It stores the information acquired by the acquisition unit 12.

[0025] The output unit 17 writes information such as the split key to the IC card 3. It also outputs the information to the first user terminal 4. Note that the acquisition unit 12 and the output unit 17 are examples of an IC card reader / writer.

[0026] Next, an example of the functional configuration of the second HSM2 of the embodiment will be described using Figure 3. Figure 3 is a block diagram showing an example of the functional configuration of the second HSM2 of the embodiment. As shown in Figure 3, the second HSM2 includes an authentication unit 21, an acquisition unit 22, a splitting unit 23, a restoration unit 24, a restriction unit 25, a storage unit 26, and an output unit 27.

[0027] The authentication unit 21 is, for example, the PIN (Personal Identification Number) code authentication unit of the IC card 3. The authentication unit 21 generates information to set (write) the PIN code entered from the second user terminal 5 to the IC card 3.

[0028] The acquisition unit 22 acquires, for example, information input from the second user terminal 5. It also acquires secret information and a secret key. It also acquires a splitting key from the IC card 3. The acquired information, including the secret key, is sent to other functional components such as the splitting unit 23, the restoration unit 24, and the storage unit 26.

[0029] The splitting unit 23 takes the key splitting unit as an example. For instance, it splits the private key acquired by the acquisition unit 22 into multiple split keys. It also receives a key generation request from the second user terminal 5 and generates the key.

[0030] The recovery unit 24, for example, obtains the split key from the IC card 3 containing the split key using the acquisition unit 22, and uses the multiple acquired split keys to recover the private key.

[0031] The restriction unit 25 is an example of a key usage restriction unit. For example, when a private key is recovered from a partitioned key using an IC card 3, the restriction unit 25 sets a recovery deadline for the private key to be recovered based on the restriction conditions stored in the IC card 3. Specifically, when recovering a private key with fewer IC cards 3 than the total number, the number of recoverable attempts and the recovery period can be set based on the restriction conditions stored in the IC card 3.

[0032] The storage unit 26, for example, is a key database. It stores the information acquired by the acquisition unit 22.

[0033] The output unit 27 writes the information to be read from the IC card 3 to the IC card 3. It also outputs the information to the second user terminal 5. Note that the acquisition unit 22 and output unit 27 are examples of an IC card reader / writer.

[0034] Next, an example of the functional configuration of the IC card 3 of the embodiment will be described using Figure 4. Figure 4 is a block diagram showing an example of the functional configuration of the IC card 3 of the embodiment. As shown in Figure 4, the IC card 3 comprises a storage unit 30 and a processing unit 31.

[0035] The storage unit 30 is exemplified by a partitioned key database. The storage unit 30 includes constraint conditions 301, a list of stored key indexes 302, the total number of key partitions 303, a list of outputted key indexes 304, and so on.

[0036] Restriction condition 301 is, for example, the recovery period of IC card 3 set from the first HSM1.

[0037] The stored key index list 302 is, for example, a list of the partition keys stored on the corresponding IC card 3. For example, it includes the first partition key, second partition key, third partition key, etc., as described later.

[0038] The total key partitioning count of 303 refers, for example, to the total number of partitioning keys generated by the first HSM1.

[0039] The output key index list 304 is, for example, a list of the split keys stored in the corresponding IC card 3 that are output to the second HSM2.

[0040] The processing unit 31 includes a deletion unit. The processing unit 31 may, for example, delete any multiple partition keys stored in the storage unit 30 if two or more of them are output to the second HSM2.

[0041] Next, an example of the hardware configuration of the first HSM1 and the second HSM2 of the embodiment will be described using Figure 5. Figure 5 is an explanatory diagram showing an example of the hardware configuration of the first HSM1 and the second HSM2 of the embodiment.

[0042] The first HSM1 and the second HSM2 are equipped with a control device such as a CPU 101, storage devices such as a ROM (Read Only Memory) 102 and a RAM (Random Access Memory) 103, a communication interface 104 for network connectivity and communication, and a bus 105 for connecting the various components. The first user terminal 4 and the second user terminal 5 have a similar hardware configuration.

[0043] The programs executed by the encryption device, decryption device, and key management system 9 of the embodiment are provided pre-installed in a ROM 102 or the like.

[0044] Furthermore, the programs executed by the encryption device, decryption device, and key management system 9 of the embodiment may be configured to be provided as a computer program product by recording them in an installable or executable file format onto a computer-readable recording medium such as a CD-ROM (Compact Disk Read Only Memory), flexible disk (FD), CD-R (Compact Disk Recordable), or DVD (Digital Versatile Disk).

[0045] Furthermore, the encryption device, decryption device, and program executed by the key management system 9 of this embodiment may be configured to be stored on a computer connected to a network such as the Internet and provided by downloading them via the network. Alternatively, the program executed by the electronic contract system according to this embodiment may be provided or distributed via a network such as the Internet.

[0046] The program executed by the encryption device, decryption device, and key management system 9 according to this embodiment can cause the computer to function as the respective parts of the encryption device, decryption device, and key management system 9 described above. This computer can read the program from a computer-readable storage medium onto its main memory and execute it using the CPU 101.

[0047] From here, using Figure 6, we will explain an example configuration in which the partitioned key generated by the first HSM1 is stored in multiple IC cards 3. Figure 6 is a diagram showing an example configuration of the partitioned key stored in the IC cards 3 of the embodiment.

[0048] Using Figure 6, we will explain the case where IC card 3 consists of a total of three cards: IC card 3-A, IC card 3-B, and IC card 3-C. For example, the private key is divided into three parts by the first HSM1, and these three parts are designated as the first divided key, the second divided key, and the third divided key.

[0049] For example, a second HSM2 can be used to recover the private key by combining the first, second, and third partitioned keys.

[0050] The first HSM1 writes the partitioning keys to multiple IC cards 3. For example, at least two of the partitioning keys are written to each of the multiple IC cards 3 in different combinations.

[0051] Specifically, IC card 3-A outputs the first and third partitioning keys from the first HSM1. IC card 3-B outputs the first and second partitioning keys from the first HSM1. IC card 3-C outputs the second and third partitioning keys from the first HSM1. Note that it is sufficient for at least two of the multiple partitioning keys to be included in any one of the IC cards 3. It is not necessary for all IC cards 3 to contain two or more partitioning keys.

[0052] Furthermore, split key information, including multiple split keys, is written to each IC card 3 from the first HSM1. The split key information includes, for example, restriction conditions 301, a list of stored key indexes 302, the total number of key splits 303, and a list of output key indexes 304.

[0053] Next, using Figure 7, we will explain the process by which the first HSM1 generates a split key and outputs the split key to multiple IC cards 3. Figure 7 is a flowchart showing an example of encryption processing by the first HSM1 in this embodiment.

[0054] As shown in Figure 7, the acquisition unit 12 of the first HSM1 acquires secret information from the first user terminal 4 through user operation, for example, and receives a key generation request (step S1).

[0055] The splitting unit 13 of the first HSM1 receives a key generation request from the acquisition unit 12, for example, and generates a key (step S2). The output unit 17 of the first HSM1 sends a notification to the first user terminal 4 that the key generation is complete (step S3).

[0056] The acquisition unit 12 of the first HSM1 acquires information about the partition key from, for example, the first user terminal 4. The information about the partition key includes, for example, the total number of partition keys to be generated (total number of key partitions 3030), the restriction conditions 301, and the PIN code to be set on the IC card 3 (step S4).

[0057] The partitioning unit 13 of the first HSM1 generates multiple partition keys from the secret key. For example, it generates them according to the total number of partition keys to be generated obtained from the first user terminal 4 (step S5).

[0058] The output unit 17 of the first HSM1 requests the first user terminal 4 to insert the first IC card 3 (step S6). The acquisition unit 12 of the first HSM1 sends information that the first IC card 3-A has been inserted to the output unit 17, etc., for example, when the user inserts the first IC card 3-A.

[0059] The output unit 17 of the first HSM1 writes information about the splitting key to, for example, the first IC card 3-A (step S7).

[0060] In step S7, the authentication unit 11 of the first HSM1 receives information that, for example, an IC card 3 has been inserted and sends information to the output unit 17 to set a PIN code on the IC card 3. The output unit 17 then sets a PIN code on the IC card 3.

[0061] Furthermore, in step S7, the output unit 17 writes at least two or more of the division keys generated by the division unit 13 to the IC card 3 in different combinations. For example, the first IC card 3-A is output with the first division key and the third division key.

[0062] Furthermore, it is not necessary to output multiple splitting keys to multiple IC cards 3; it is acceptable to output two or more types of splitting keys to at least one IC card 3 and output one splitting key to the other IC cards 3.

[0063] Furthermore, in step S7, the restriction unit 15 sends information regarding the restriction conditions to the output unit 17. The output unit 17 then outputs the restriction conditions 301 to the IC card 3. The information regarding the restriction conditions 301 is, for example, information that sets a time limit for recovering the private key when recovering the private key while at least one of the IC cards 3 is missing due to malfunction, loss, etc.

[0064] The restriction unit 15 sets the restriction conditions obtained from the first user terminal 4. Alternatively, it may set the restriction conditions 301 stored in the storage unit 16.

[0065] Next, the output unit 17 of the first HSM1 requests the first user terminal 4 to insert the second IC card 3 (step S8). The acquisition unit 12 of the first HSM1 sends information about the insertion to the output unit 17, etc., for example, when the second IC card 3-B is inserted by the user.

[0066] The output unit 17 of the first HSM1 writes information about the split key to, for example, the second IC card 3-B (step S9).

[0067] In step S9, the same processing as in step S7 is performed. Specifically, for example, the authentication unit 11 sets a PIN code on IC card 3-B via the output unit 17. The output unit 17 also outputs the first partition key and the second partition key to, for example, the second IC card 3-B. Furthermore, the restriction unit 15 outputs the restriction condition 301 to IC card 3-B via the output unit 17.

[0068] Similarly, the output unit 17 of the first HSM1 requests the first user terminal 4 to insert the third IC card 3 (step S10). The acquisition unit 12 of the first HSM1 sends information about the insertion to the output unit 17, for example, when the user inserts the third IC card 3-C.

[0069] The output unit 17 of the first HSM1 writes information about the split key to, for example, the third IC card 3-C (step S11).

[0070] In step S11, the same processing as in step S7 is performed. Specifically, for example, the authentication unit 11 sets a PIN code on the IC card 3-C via the output unit 17. The output unit 17 also outputs the second and third partition keys to the third IC card 3-C, for example. Furthermore, the restriction unit 15 outputs the restriction condition 301 to the IC card 3-C via the output unit 17.

[0071] After writing to IC cards 3-A to 3-C is complete, the output unit 17 of the first HSM1 sends a completion notification to the first user terminal 4 (step S12).

[0072] As a result, multiple IC cards 3 each store at least two or more of the multiple partitioning keys in different combinations. This ensures that even if one of the IC cards 3 is missing when the private key is being recovered, the private key can still be recovered because each IC card 3 still stores multiple partitioning keys.

[0073] Next, using Figure 8, we will explain an example of how the second HSM2 recovers a secret key using multiple IC cards 3, where all of the multiple IC cards 3 on which the split key is written are present. Figure 8 is a flowchart showing an example of the recovery process by the second HSM2 in the embodiment.

[0074] As shown in Figure 8, the acquisition unit 22 of the second HSM2 receives a request to import the IC card 3 from the second user terminal 5. At this time, the PIN code for each IC card 3 is also acquired (step S101).

[0075] The output unit 27 of the second HSM2 requests the insertion of IC card 3 to the second user terminal 5 (step S102). The acquisition unit 22 of the second HSM2 sends the inserted information to the authentication unit 21, for example, when the first IC card 3-A is inserted by the user.

[0076] The authentication unit 21 of the second HSM2 authenticates the acquired IC card 3-A using, for example, the PIN code of IC card 3-A entered from the second user terminal 5. If authentication is successful, the output unit 27 of the second HSM2 requests data read information from IC card 3-A (step S103).

[0077] The data retrieval information includes, for example, the total number of key divisions 303 stored in IC card 3-A, the stored key index list 302, and the output key index list 304.

[0078] The acquisition unit 22 of the second HSM2 acquires information about the partitioned keys, such as the total number of key partitions 303, the stored key index list 302, and the output key index list 304, from the IC card 3-A (step S104).

[0079] The output unit 27 of the second HSM2 reads the first partition key from the IC card 3-A (step S105).

[0080] IC card 3-A updates the information in the output key index list 304. For example, it updates the information that the first partition key has been output. The information may also be updated by the second HSM2 (step S106).

[0081] The acquisition unit 22 of the second HSM2 acquires the first partition key from the IC card 3-A (step S107).

[0082] The acquisition unit 22 of the second HSM2 requests the insertion of IC card 3 from the second user terminal 5 (step S108). If, for example, a second IC card 3-B is inserted by the user, the acquisition unit 22 of the second HSM2 sends the inserted information to the authentication unit 21.

[0083] The authentication unit 21 of the second HSM2 authenticates the acquired IC card 3-B using, for example, the PIN code of IC card 3-B entered from the second user terminal 5. If authentication is successful, the output unit 27 of the second HSM2 reads the second partition key from IC card 3-B (step S109).

[0084] IC card 3-B updates the information in the output key index list 304. For example, it updates the information that the second partition key has been output. The information may also be updated by the second HSM2 (step S110).

[0085] The acquisition unit 22 of the second HSM2 acquires the second partition key from the IC card 3-B (step S111).

[0086] The acquisition unit 22 of the second HSM2 requests the insertion of IC card 3 from the second user terminal 5 (step S112). If, for example, a third IC card 3-C is inserted by the user, the acquisition unit 22 of the second HSM2 sends the inserted information to the authentication unit 21.

[0087] The authentication unit 21 of the second HSM2 authenticates the acquired IC card 3-C using, for example, the PIN code of the IC card 3-C entered from the second user terminal 5. If authentication is successful, the output unit 27 of the second HSM2 reads the third partition key from the IC card 3-C (step S113).

[0088] IC card 3-C updates the information in the output key index list 304. For example, it updates the information that the third partition key has been output. The information may also be updated by the second HSM2 (step S114).

[0089] The acquisition unit 22 of the second HSM2 acquires the third partition key from the IC card 3-C (step S115).

[0090] The recovery unit 24 of the second HSM2 combines the first partition key, the second partition key, and the third partition key obtained from the IC card 3 (step S116).

[0091] The recovery unit 24 of the second HSM2 recovers the private key using the first partitioned key, the second partitioned key, and the third partitioned key (step S117).

[0092] The output unit 27 of the second HSM2 notifies the second user terminal 5 that the private key has been restored (step S118).

[0093] The above describes how to recover the private key using all of the IC cards 3. Next, using Figure 9, we will explain how to recover the private key when at least one of the IC cards 3 is missing.

[0094] Figure 9 is a flowchart showing an example of the recovery process when the IC card 3 is missing by the second HSM2 in the second embodiment.

[0095] As shown in Figure 9, the acquisition unit 22 of the second HSM2 receives a request to import the IC card 3 from the second user terminal 5. At this time, the PIN code for each IC card 3 is also acquired (step S201).

[0096] The output unit 27 of the second HSM2 requests the second user terminal 5 to insert the IC card 3 (step S202). In the second embodiment, an example is taken where IC card 3-A is missing due to malfunction, loss, etc. The acquisition unit 22 of the second HSM2 sends the inserted information to the authentication unit 21 when, for example, IC card 3-B is inserted by the user.

[0097] The authentication unit 21 of the second HSM2 authenticates the acquired IC card 3-B using, for example, the PIN code of the IC card 3-B entered from the second user terminal 5. If authentication is successful, the output unit 27 of the second HSM2 requests data read information from the IC card 3-B (step S203).

[0098] The data retrieval information includes, for example, the total number of key divisions 303 stored in IC card 3-B, the stored key index list 302, and the output key index list 304.

[0099] The acquisition unit 22 of the second HSM2 acquires information about the partitioned keys, such as the total number of key partitions 303, the stored key index list 302, and the output key index list 304, from the IC card 3-B (step S204).

[0100] The output unit 27 of the second HSM2 reads the first partition key from the IC card 3-B (step S205).

[0101] IC card 3-B updates the information in the output key index list 304. For example, it updates the information that the first partition key has been output. The information may also be updated by the second HSM2 (step S206).

[0102] The acquisition unit 22 of the second HSM2 acquires the first partition key from the IC card 3-B (step S207).

[0103] The acquisition unit 22 of the second HSM2 again requests the second user terminal 5 to insert the IC card 3 (step S208). If, for example, the user inserts the same IC card 3-B as the first one, the acquisition unit 22 of the second HSM2 sends the inserted information to the authentication unit 21.

[0104] The authentication unit 21 of the second HSM2 authenticates the acquired IC card 3-B using, for example, the PIN code of IC card 3-B entered from the second user terminal 5. If authentication is successful, the output unit 27 of the second HSM2 reads the second partition key from IC card 3-B (step S209).

[0105] IC card 3-B updates the information in the output key index list 304. For example, it updates the information that the second partition key has been output, in addition to the information that the first partition key has been output. The information may also be updated by the second HSM2 (step S210).

[0106] If, for example, the information that the first and second partition keys have been output from the output key index list 304 is updated, the processing unit 31 of IC card 3-B may delete the information in the storage unit 30, such as the information of the first and second partition keys, at a predetermined timing. The predetermined timing may be, for example, when the information that multiple keys have been output from the output key index list 304 is updated, or when IC card 3 is read for the next time (step S211).

[0107] The acquisition unit 22 of the second HSM2 acquires the second partition key from the IC card 3-B (step S212).

[0108] The acquisition unit 22 of the second HSM2 requests the insertion of IC card 3 from the second user terminal 5 (step S213). If, for example, IC card 3-C is inserted by the user, the acquisition unit 22 of the second HSM2 sends the inserted information to the authentication unit 21.

[0109] The authentication unit 21 of the second HSM2 authenticates the acquired IC card 3-C using, for example, the PIN code of the IC card 3-C entered from the second user terminal 5. If authentication is successful, the output unit 27 of the second HSM2 reads the third partition key from the IC card 3-C (step S214).

[0110] IC card 3-C updates the information in the output key index list 304. For example, it updates the information that the third partition key has been output. The information may also be updated by the second HSM2 (step S215).

[0111] The acquisition unit 22 of the second HSM2 acquires the third partition key from the IC card 3-C (step S216).

[0112] The recovery unit 24 of the second HSM2 combines the first partition key, the second partition key, and the third partition key obtained from the IC card 3 (step S217).

[0113] The recovery unit 24 of the second HSM2 recovers the private key using the first partitioned key, the second partitioned key, and the third partitioned key. At this time, since the first partitioned key and the second partitioned key have been obtained from IC card 3-B, the restriction unit 25 sets an expiration date for recovering the private key based on the restriction conditions 301 obtained from IC card 3-B (step S218).

[0114] The output unit 27 of the second HSM2 notifies the second user terminal 5 that the private key has been restored and that an expiration date has been set for restoring the private key (step S219).

[0115] As a result, even if there are insufficient IC cards 3 to be used for recovery compared to the total number of IC cards 3 issued, the private key can be recovered using an IC card 3 containing multiple split keys, since the IC card 3 contains multiple split keys.

[0116] Specifically, for example, if IC card 3-A is missing, the private key can be recovered by obtaining the first and second partition keys from IC card 3-B and the third partition key from IC card 3-C. Alternatively, the second and third partition keys could be obtained from IC card 3-C.

[0117] Furthermore, if recovery is performed while IC card 3 is insufficient, a recovery period for the private key can be set based on restriction condition 301. This allows for recovery even when IC card 3 is insufficient, and the setting of a recovery period for the private key reduces the risk of misuse.

[0118] Specifically, for example, if the first and second partition keys are obtained from IC card 3-B, the output key index list 304 will consist of two keys: the first and second partition keys. In this case, the second HSM2 may determine that IC card 3 is insufficient and set a time limit for recovering the private key.

[0119] Alternatively, the user may input to the second HSM2 that IC card 3 is missing, thereby setting a time limit for recovering the private key.

[0120] As a variation, one of the multiple partition keys stored on IC card 3 is designated as the primary partition key, and the second as the secondary partition key. The private key can be recovered by combining the primary partition keys of multiple IC cards 3. The private key can also be recovered by combining the secondary partition keys of multiple IC cards 3.

[0121] Taking IC card 3 shown in Figure 6 as an example, IC card 3-A uses the first partitioning key as the primary partitioning key and the third partitioning key as the secondary partitioning key. IC card 3-B uses the second partitioning key as the primary partitioning key and the first partitioning key as the secondary partitioning key. IC card 3-C uses the third partitioning key as the primary partitioning key and the second partitioning key as the secondary partitioning key.

[0122] The second HSM2, for example, determines that there is nothing missing on IC card 3 if the private key is recovered using only the primary partition key. Conversely, if the secondary partition key is obtained, it may determine that IC card 3 is insufficient, and in this case, an expiration date may be set for the recovered private key.

[0123] The expiration date of the private key may be set so that, for example, the private key can only be recovered once, and the split key may be erased from IC card 3 so that the private key cannot be recovered a second time or later.

[0124] Next, using Figure 10, we will explain that there is no limit to the number of IC cards 3 used to write the split key; any number of cards is acceptable. Figure 10 shows an example of the configuration of the split key stored in the IC card 3 of the third embodiment.

[0125] As shown in Figure 10, the private key is divided into four parts, and the divided keys are output from IC card 3-A to IC card 3-D. The divided key information is also output.

[0126] Specifically, for example, IC card 3-A stores the first partitioning key, the second partitioning key, and partitioning key information. IC card 3-B stores the second partitioning key, the third partitioning key, and partitioning key information. IC card 3-C stores the third partitioning key, the fourth partitioning key, and partitioning key information. IC card 3-D stores the first partitioning key, the fourth partitioning key, and partitioning key information.

[0127] This allows the private key to be recovered even if at least one of the IC cards 3 is missing. In this embodiment, the cases of 3 and 4 IC cards 3 were described as examples, but the total number of IC cards 3 may be 2 or 5 or more. Furthermore, it is sufficient that multiple partition keys are stored on at least one IC card 3.

[0128] The encryption device of this embodiment includes an acquisition unit that acquires a secret key, a division unit that divides the secret key into a plurality of division keys, and an output unit that writes at least two types of division keys from the plurality of division keys to each of a plurality of IC cards in different combinations.

[0129] According to this, since multiple IC cards contain two or more types of splitting keys, even if a predetermined number of IC cards malfunction or are lost, it is possible to generate IC cards that can recover the private key.

[0130] The decryption device of this embodiment includes an acquisition unit that acquires partition keys from a plurality of IC cards, each of which stores at least two or more partition keys from a plurality of partition keys in different combinations; a restoration unit that restores a secret key using the acquired plurality of partition keys; and an output unit that outputs the secret key.

[0131] According to this, since multiple IC cards contain two or more splitting keys, even if the number of acquired IC cards is less than the total number of IC cards, the private key can be recovered using the splitting keys of multiple IC cards.

[0132] The encryption device of this embodiment further comprises a restriction unit that generates information indicating that an expiration date for the recovery of the secret key is set when the secret key is recovered using a partition key of a plurality of IC cards that is less than the total number of IC cards, and an output unit writes information indicating that an expiration date for the recovery of the secret key is set when the secret key is recovered using a partition key of a plurality of IC cards that is less than the total number of IC cards to a plurality of IC cards.

[0133] According to this, it is possible to set an expiration date for the recovery of a private key when the private key is recovered using the partition keys of multiple IC cards, which are fewer than the total number of IC cards. Therefore, even if there are not enough IC cards to use for recovery, the private key can still be recovered. Furthermore, by setting an expiration date for the recovery of the private key, the private key can be managed securely. For example, even if an IC card is lost, the expiration date for recovery is set, which reduces the risk of misuse.

[0134] The output unit of the encryption device in this embodiment outputs the total number of IC cards when writing the split key to multiple IC cards. This allows for the management of issues such as insufficient IC cards when the private key is being recovered, as the total number of IC cards is known at the time of recovery.

[0135] The output unit of the encryption device in this embodiment writes two or more types of splitting keys to at least one of the multiple IC cards. As a result, even if the number of IC cards is less than the total number of cards, the secret key can be recovered by using multiple IC cards, including IC cards that store two or more types of splitting keys.

[0136] The partitioning unit of the encryption device in this embodiment divides multiple partitioning keys into multiple primary partitioning keys and multiple partitioning keys equal to the number of primary partitioning keys into multiple secondary partitioning keys, and the output unit writes the primary and secondary partitioning keys to each of the multiple IC cards in different combinations.

[0137] According to this, each IC card contains a primary partitioning key and a secondary partitioning key. Therefore, even if a predetermined number of IC cards malfunction or are lost, the private key can be recovered using the secondary partition key.

[0138] The encryption device of this embodiment further comprises a restriction unit that generates information indicating that an expiration date for the recovery of the secret key is set when the secret key is recovered using a secondary partitioning key, and an output unit that writes information indicating that an expiration date for the recovery of the secret key is set when the secret key is recovered using a secondary partitioning key to multiple IC cards.

[0139] According to this, if the private key is recovered using a secondary partitioned key, a time limit for recovering the private key can be set, taking into account the possibility of losing the IC card, thus ensuring the secure management of the private key.

[0140] The decryption device of this embodiment further includes a limiting unit that sets an expiration date for the recovery of the secret key when the secret key is recovered using a number of partition keys for IC cards that is less than the total number of IC cards.

[0141] According to this, when a private key is recovered using the partition keys of multiple IC cards, which are fewer than the total number of IC cards, it is possible to set an expiration date for the recovery of the private key. Therefore, the private key can be recovered using fewer IC cards than the total number, and by setting an expiration date for the recovery of the private key, the private key can be managed securely.

[0142] The acquisition unit of the decryption device in this embodiment acquires information on the total number of IC cards stored on multiple IC cards. Knowing the total number of IC cards allows for management of issues such as missing IC cards when recovering a private key.

[0143] In the decryption device of this embodiment, the plurality of IC cards include a plurality of primary partition keys and a plurality of secondary partition keys which are the same as the plurality of primary partition keys, and if the decryption unit cannot decrypt the secret key using a plurality of primary partition keys of a plurality of IC cards that is less than the total number of IC cards, it decrypts the secret key using a secondary partition key of any of the IC cards.

[0144] According to this, each IC card contains a primary partitioning key and a secondary partitioning key. Therefore, even if a predetermined number of IC cards malfunction or are lost, the private key can be recovered using the secondary partition key.

[0145] The decryption device of this embodiment further includes a limiting unit that sets an expiration date for the recovery of the private key when the private key is recovered using a secondary partitioning key. With this, when the private key is recovered using a secondary partitioning key, the private key can be managed securely by setting an expiration date for the recovery of the private key, taking into account the possibility of loss of the IC card.

[0146] The key management system of this embodiment is a key management system comprising an encryption device that divides a private key into partition keys, and a decryption device that restores the private key from the partition keys, wherein the encryption device comprises an acquisition unit that acquires a private key, a partitioning unit that divides the private key into a plurality of partition keys, and an output unit that writes at least two or more partition keys from the plurality of partition keys in different combinations to each of a plurality of IC cards, and the decryption device comprises an acquisition unit that acquires partition keys from a plurality of IC cards, each of which stores at least two or more partition keys from the plurality of partition keys in different combinations, a restoration unit that restores the private key using the plurality of partition keys, and an output unit that outputs the private key.

[0147] Although several embodiments of the present invention have been described above, these embodiments are presented as examples and are not intended to limit the scope of the invention. These embodiments can be carried out in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their variations are included in the scope and spirit of the invention, as well as in the claims and their equivalents. [Explanation of symbols]

[0148] 1: First HSM 2: The second HSM 3: IC card 4: First user terminal 5: Second user terminal 9: Key Management System 11,21: Authentication Department 12,22: Acquisition part 13,23:Divided part 14,24: Restoration section 15,25: Restriction section 16,26: Storage part 17,27: Output section 30: Storage part 31: Processing Unit 41,51:Operation unit 301: Restrictions 302: Stored Key Index List 303: Number of overall key divisions 304: Output Key Index List

Claims

1. The acquisition unit for obtaining the private key, A partitioning unit that divides the aforementioned private key into multiple partitioning keys, An output unit that writes at least two or more of the aforementioned division keys from among the multiple division keys to each of the multiple IC cards in different combinations, An encryption device equipped with the following features.

2. An acquisition unit that acquires the partition keys from multiple IC cards, each of which stores at least two or more of the partition keys in different combinations, A recovery unit that recovers the private key using multiple partitioned keys, An output unit that outputs the aforementioned secret key, A decoding device equipped with the following features.

3. The output unit is, Even if one of the multiple IC cards is missing, the private key can be recovered using the remaining multiple IC cards. Write at least two or more of the division keys from the plurality of division keys in different combinations to each of the plurality of IC cards. The encryption device according to claim 1.

4. The system further includes a restriction unit that generates information indicating that a recovery period for the private key is set when the private key is recovered using the partition keys of a plurality of IC cards that are fewer than the total number of IC cards, The output unit is, When the private key is restored using the partition keys of a number of IC cards less than the total number of IC cards, information is written to the number of IC cards to set an expiration date for the restoration of the private key. The encryption device according to claim 1.

5. The output unit is, When writing the aforementioned partition key to multiple IC cards, output the total number of IC cards. The encryption device according to claim 1.

6. The output unit is, Write two or more of the division keys to at least one of the multiple IC cards. The encryption device according to claim 1.

7. The aforementioned divided portion is The multiple partition keys are divided into multiple primary partition keys, and the same multiple partition keys as the multiple primary partition keys are divided into multiple secondary partition keys. The output unit is, The primary partitioning key and the secondary partitioning key are written to each of the multiple IC cards in different combinations. The encryption device according to claim 1.

8. The system further comprises a limiting unit that generates information indicating that an expiration date is set for the recovery of the private key when the private key is recovered using the secondary partitioning key, The output unit is, When the private key is restored using the secondary partition key, information is written to multiple IC cards to set an expiration date for the restoration of the private key. The encryption device according to claim 7.

9. A restriction unit sets an expiration date for the restoration of the private key when the private key is restored using the partition keys of a plurality of IC cards, which is fewer than the total number of IC cards. The decoding device according to claim 2, further comprising:

10. The acquisition unit is, To obtain information on the total number of IC cards stored in multiple IC cards, The decoding device according to claim 2.

11. The plurality of IC cards include a plurality of principal partition keys and a plurality of secondary partition keys which are the same as the plurality of principal partition keys, The restoration unit is, If the private key cannot be restored using the partition keys of the principal IC cards of a plurality of IC cards that are fewer than the total number of IC cards, The private key is recovered using the secondary partition key of one of the IC cards. The decoding device according to claim 2.

12. A limiting unit that sets an expiration date for the restoration of the private key when the private key is restored using the secondary partitioning key, The decoding device according to claim 11, further comprising:

13. A key management system comprising an encryption device that divides a private key into partitioned keys, and a decryption device that recovers the private key from the partitioned keys, The encryption device is The acquisition unit acquires the aforementioned secret key, A partitioning unit that divides the aforementioned private key into multiple partitioning keys, The system includes an output unit that writes at least two or more of the aforementioned division keys from a plurality of division keys to each of a plurality of IC cards in different combinations, The aforementioned decoding device, An acquisition unit that acquires the partition keys from multiple IC cards, each of which stores at least two or more of the partition keys in different combinations, A recovery unit that recovers the private key using multiple partition keys, The system includes an output unit that outputs the aforementioned secret key, Key management system.

Images