COMMUNICATION SYSTEM, TRANSMITTER, RECEIVER, AND METHOD AND PROGRAM THEREOF

Abstract

This transmitting device is a device for transmitting a message to a receiving device by using a common key and a pseudo-random function, which the transmitting device shares with the receiving device, and a generated nonce, the transmitting device comprising: a first ECC unit that calculates a first error-correcting code from the message; an ENC unit that outputs a cipher obtained by additive encryption of a combination of the message and the first error-correcting code by using a random number obtained by inputting the nonce to the pseudo-random function; an MAC unit that calculates a message authentication tag by using the common key for the message and the nonce; a second ECC unit that calculates a second error-correcting code from the nonce; and a transmitting unit that transmits the cipher, the message authentication tag, the nonce, and the second error-correcting code to the receiving device.

Description

[Technical field]

[0001] The present invention relates to a communication system, a transmitting device, a receiving device, and methods and programs thereof. [Background technology]

[0002] Message authentication code (MAC) is a technology that guarantees the authenticity of a message by assigning a tag that can only be calculated by someone who knows the common key to the message. For example, message authentication makes it possible to detect tampering by a third party during communication between two parties who share a common key. Specifically, if the common key shared by the sender and receiver of a message is K and the message is M, then the sender sends the tag T = MAC(K,M) along with the message M to the receiver. Note that MAC(K,M) refers to a function F that takes M and K as input and outputs the tag T.

[0003] The message and tag received by the receiver via the communication channel are called message M' and tag T', respectively. The receiver who receives message M' and tag T' calculates tag T'' using the received message M' and key K shared with the sender. Here, by checking whether the received tag T' matches or does not match T'', it is possible to determine whether message M' was sent from a legitimate sender.

[0004] Meanwhile, since errors due to natural factors can occur in communications, it is common to also apply error-correcting codes (ECC). In this case, the error-correcting code is usually applied to the entire communication content. In other words, when message authentication is used, the error-correcting code is encoded on the entire sequence (M||T) that concatenates the message M and the tag T = MAC(M) (note that || denotes the concatenation operator). If the encoding process for an arbitrary binary sequence x is g(x), the transmitted content becomes g(M||MAC(M)). The receiver first performs error correction processing, and then performs MAC verification processing on the obtained estimate of (M||T).

[0005] Furthermore, Patent Document 1 describes a method for applying an error correction code to a message M, rather than to the entire communication content, and for performing message authentication processing and error correction code processing in parallel. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] International Publication No. 2018 / 109906 Summary of the Invention [Problem to be solved by the invention]

[0007] The disclosures of the above-mentioned prior art documents are incorporated herein by reference. The following analysis was conducted by the present inventors.

[0008] By the way, one of the communication technologies is Authenticated Encryption (AE). Authenticated encryption is a technology that encrypts messages for communication and guarantees that the messages are authentic, and it is a combination of the above-mentioned message authentication and encryption.

[0009] Furthermore, just as it is common to apply error correcting codes in the message authentication described above, it is also common to apply error correcting codes to authenticated encryption by applying error correcting codes to the entire communication content.

[0010] Therefore, it is possible to process the authenticated encryption process and the error correcting code process in parallel as in Patent Document 1, but it is not possible to make it function correctly by simply adding encryption before and after the method described in Patent Document 1. Methods of combining encryption and message authentication in authenticated encryption include the EtM (Encrypt-then-MAC) method, which encrypts a message and calculates a MAC tag from the ciphertext, the MtE (MAC-then-Encrypt) method, which calculates a MAC from a message and encrypts the message and the MAC tag in a linked state, and the EaM (Encrypt-and-MAC) method, which calculates a MAC tag from a message and encrypts the message, and transmits the ciphertext and the MAC tag in a linked state, and so on. This is because it is necessary to appropriately combine the relationship between each process in authenticated encryption and the error correcting code process.

[0011] In view of the above-mentioned problems, an object of the present invention is to provide a communication system, a transmitting device, a receiving device, and methods and programs thereof that contribute to parallelizing authentication encryption processing and error correction code processing. [Means for solving the problem]

[0012] In a first aspect of the present invention, there is provided a communication system for transmitting a message from a transmitting device to a receiving device by using a common key and a pseudorandom function shared between the transmitting device and the receiving device, and a nonce generated by the transmitting device, the transmitting device including a first ECC unit for calculating a first error correcting code from the message, an ENC unit for additively encrypting a combination of the message and the first error correcting code using a random number obtained by inputting the nonce to the pseudorandom function, and outputting a ciphertext, a MAC unit for calculating a message authentication tag for the message and the nonce by using the common key, a second ECC unit for calculating a second error correcting code from the nonce, and a random number generating the ciphertext, the message authentication tag, the nonce, and the second error correcting code. and a transmitting unit that transmits the nonce to the receiving device, the receiving device comprising: a second ECC decoding unit that performs error correction on the nonce using the second error correcting code, a DEC unit that decodes the message and the first error correcting code from the ciphertext using a random number obtained by inputting the nonce to the pseudorandom function, a first ECC decoding unit that performs error correction on the message using the first error correcting code, a verification MAC unit that calculates a verification message authentication tag using the common key from the message output by the first ECC decoding unit and the nonce output by the second ECC decoding unit, and an output unit that compares the verification message authentication tag with the message authentication tag and outputs the message if they are within a predetermined range.

[0013] In a second aspect of the present invention, there is provided a transmitting device and a receiving device constituting the above communication system.

[0014] In a third aspect of the present invention, there is provided a communication method for transmitting a message from a transmitting device to a receiving device by using a common key and a pseudorandom function shared between the transmitting device and the receiving device, and a nonce generated by the transmitting device, the transmitting device calculating a first error correcting code from the message, and inputting the nonce into the pseudorandom function to obtain a random number, additively encrypting a combination of the message and the first error correcting code to output a ciphertext, calculating a message authentication tag for the message and the nonce by using the common key, calculating a second error correcting code from the nonce, and additively encrypting the ciphertext and the message authentication A communication method is provided in which a tag, the nonce, and the second error correcting code are transmitted to the receiving device, and the receiving device performs error correction on the nonce using the second error correcting code, decodes the message and the first error correcting code from the ciphertext using a random number obtained by inputting the nonce to the pseudorandom function, performs error correction on the message using the first error correcting code, calculates a verification message authentication tag from the error-corrected message and the nonce using the common key, compares the verification message authentication tag with the message authentication tag, and outputs the message if the comparison is within a predetermined range.

[0015] In a fourth aspect of the present invention, there are provided a transmitting method and a receiving method constituting the above communication method.

[0016] In a fifth aspect of the present invention, there is provided a communications program for causing a transmission device to perform a process of transmitting a message from the transmission device to the reception device by using a common key and a pseudorandom function shared between the transmission device and the reception device, and a nonce generated by the transmission device, the communications program including the steps of: calculating a first error correcting code from the message; inputting the nonce into the pseudorandom function to obtain a random number, additively encrypting a combination of the message and the first error correcting code to output a ciphertext; calculating a message authentication tag for the message and the nonce by using the common key; calculating a second error correcting code from the nonce; and additively encrypting the ciphertext and the message authentication tag. A communications program is provided that causes a process to be performed to transmit the nonce and the second error correcting code to the receiving device, and causes the receiving device to perform processes to error-correct the nonce using the second error correcting code, decrypt the message and the first error correcting code from the ciphertext using a random number obtained by inputting the nonce to the pseudorandom function, error-correct the message using the first error correcting code, calculate a verification message authentication tag from the error-corrected message and the nonce using the common key, compare the verification message authentication tag with the message authentication tag, and output the message if the comparison is within a predetermined range.

[0017] In a sixth aspect of the present invention, a sending program and a receiving program constituting the above-mentioned communication program are provided.

[0018] These programs can be recorded on a computer-readable storage medium. The storage medium can be a non-transient medium such as a semiconductor memory, a hard disk, a magnetic recording medium, an optical recording medium, etc. The present invention can also be embodied as a computer program product. Effect of the Invention

[0019] According to each aspect of the present invention, it is possible to provide a communication system, a transmitting device, a receiving device, and methods and programs thereof that contribute to parallelizing authentication encryption processing and error correction code processing. [Brief description of the drawings]

[0020] [Figure 1] FIG. 1 is a schematic configuration diagram of a communication system according to the first embodiment. [Diagram 2] FIG. 2 is a functional block diagram of the transmission device according to the first embodiment. [Diagram 3] FIG. 3 is a functional block diagram of the receiving device according to the first embodiment. [Figure 4] FIG. 4 is a flowchart illustrating an outline of the procedure of the transmission method according to the first embodiment. [Diagram 5] FIG. 5 is a flowchart illustrating an outline of the procedure of the receiving method according to the first embodiment. [Figure 6] FIG. 6 is a diagram illustrating an example of a hardware configuration of an apparatus used in the embodiment. [Figure 7] FIG. 7 is a schematic configuration diagram of a communication system according to the second embodiment. [Figure 8] FIG. 8 is a functional block diagram of a transmission device according to the second embodiment. [Figure 9] FIG. 9 is a functional block diagram of a receiving device according to the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0021] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. However, the present invention is not limited to the embodiment described below. In addition, in each drawing, the same or corresponding elements are appropriately assigned the same reference numerals. Furthermore, it should be noted that the drawings are schematic, and the dimensional relationship of each element, the ratio of each element, etc. may differ from the actual ones. There may also be parts in which the dimensional relationship and ratio differ between the drawings.

[0022] [First embodiment] FIG. 1 is a schematic diagram of a communication system according to a first embodiment. As shown in FIG. 1, the communication system 100 is a system for transmitting a message from a transmitting device 110 to a receiving device 120 using authentication encryption with an error correction function. For this purpose, the transmitting device 110 and the receiving device 120 share a common key K and a pseudorandom function F. The common key K is used for message authentication when transmitting a message using authentication encryption, and the pseudorandom function F is used for generating random numbers to be used for encryption. Sharing the pseudorandom function F is achieved not only by sharing the same function but also by sharing a seed for generating random numbers. The seed for generating random numbers essentially functions as a common key.

[0023] 1, the transmitting device 110 transmits a ciphertext C, a message authentication tag T, a nonce N, and an error correction code R(N) to the receiving device 120. These pieces of information are transmitted as a message using authenticated encryption with error correction function from the transmitting device 110 to the receiving device 120, using a mechanism described later.

[0024] 2 is a functional block diagram of a transmission device according to the first embodiment. As shown in FIG. 2, the transmission device 110 includes a first ECC unit 111, an ENC unit 112, a second ECC unit 113, a MAC unit 114, and a transmission unit 115.

[0025] The first ECC unit 111 calculates a first error correcting code R(M) from the message M, and outputs M||R(M) which is a combination of the message M and the first error correcting code R(M). The ENC unit 112 encrypts M||R(M) output from the first ECC unit 111 into a ciphertext C. Here, the error correction method in the first ECC unit 111 can be selected appropriately according to the communication method, but is assumed to be a linear code.

[0026] The ENC unit 112 calculates a ciphertext C using M||R(M) and nonce N output from the first ECC unit 111. The nonce N is a disposable random number generated by the transmission device 110, and a counter can be used, for example. The pseudorandom function F in the first ECC unit 111 outputs a random number in response to the input of the nonce N, and this random number is added to the M||R(M) output from the first ECC unit 111. That is, the M||R(M) output from the first ECC unit 111 is additively encrypted using a random number obtained by inputting the nonce N to the pseudorandom function F.

[0027] The second ECC unit 113 calculates a second error correcting code R(N) from the nonce N. In addition, the MAC unit 114 calculates a message authentication tag T from the message M and the nonce N as input using a common key K.

[0028] The transmitting unit 115 transmits the ciphertext C calculated as above, the message authentication tag T, the nonce N, and the second error correcting code R(N) to the receiving device 120.

[0029] 2, the processing in the first ECC unit 111 and the ENC unit 112, the processing in the second ECC unit 113, and the processing in the MAC unit 114 are parallelized. Therefore, in the transmitting device 110, the delay from the input of the message M to the transmission of the ciphertext C and the like to the receiving device 120 is reduced. Also, compared to the method of applying the error correction code generally used in conventional communication systems to the entire communication content, the amount of calculation and communication is reduced because the error correction code is not processed on the message authentication tag T.

[0030] 3 is a functional block diagram of a receiving device according to the first embodiment. As described above, the communication contents transmitted by the transmitting device 110 are different from those generally used in conventional communication methods, but as described below, the receiving device 120 can decrypt the message M from the ciphertext C', message authentication tag T', nonce N', and second error correction code R(N)' received from the transmitting device 110. Note that it is assumed that the ciphertext C', message authentication tag T', nonce N', and second error correction code R(N)' received from the transmitting device 110 contain noise or tampering, and the ciphertext C, message authentication tag T, nonce N, and second error correction code R(N) transmitted by the transmitting device 110 are distinguished by adding "'".

[0031] As shown in FIG. 3, the receiving device 120 includes a second ECC decoding unit 121, a DEC unit 122, a first ECC decoding unit 123, a verification MAC unit 124, and an output unit 125.

[0032] The second ECC decoding unit 121 performs error correction on the nonce N' using the second error correction code R(N)'. If the error correction is successful, the second ECC decoding unit 121 outputs the nonce N transmitted by the transmitting device 110. On the other hand, if the error correction is unsuccessful, the processing ends as it has not been possible to correctly receive the communication contents.

[0033] The DEC unit 122 decrypts the ciphertext C' received from the transmitting device 110 using the nonce N error-corrected by the second ECC decoding unit 121. The nonce N is input to a pseudorandom function F in the DEC unit 122 to generate a random number. At this time, the pseudorandom function F is shared by the transmitting device 110 and the receiving device 120, so that the same random number is generated for the same nonce N. Therefore, the ciphertext C' can be decrypted by calculating the difference between the random number generated by the pseudorandom function F and the ciphertext C' received from the transmitting device 110. The result of decrypting the ciphertext C' is a concatenation M||R(M)' of the message M' and the first error correcting code R(M)'.

[0034] The first ECC decoding unit 123 can decode the message M by correcting the error to M∥R(M)′ for the following reason. If the error correction fails, it is determined that the communication content could not be received correctly and the process is terminated.

[0035] The received ciphertext C' can be considered to be the ciphertext C sent plus an error vector e. That is, C'=C+e. Since the DEC unit 122 performs additive decoding, the result is M||R(M)+e. Here, since the first error correcting code R(M) is coded using a linear code, if the error vector e can be corrected, the message M can be obtained.

[0036] The verification MAC unit 124 calculates a verification message authentication tag T'' from the message M decrypted by the first ECC decryption unit 123 and the nonce N decrypted by the second ECC decryption unit 121, using the common key K. This verification message authentication tag T'' should match the message authentication tag T generated by the MAC unit 114 in the transmission device 110, unless the message M (and the nonce N) has been tampered with.

[0037] The output unit 125 compares the message authentication tag for verification T'' with the message authentication tag T' received from the transmitting device 110, and if the difference is within a predetermined range, outputs the message M obtained by the first ECC decoding unit 123. Here, the message authentication tag T' received from the transmitting device 110 does not necessarily match the message authentication tag T generated by the MAC unit 114 in the transmitting device 110. In other words, even if the message M has not been tampered with, the message authentication tag for verification T'' may not match the message authentication tag T' received from the transmitting device 110. Therefore, if the difference between the message authentication tag for verification T'' and the message authentication tag T' received from the transmitting device 110 is within a predetermined range, the output unit 125 determines that no tampering has been performed, and outputs the message M obtained by the first ECC decoding unit 123. The output unit 125 can use the Hamming distance to compare the message authentication tag for verification T'' with the message authentication tag T' received from the transmitting device 110.

[0038] As described above, the communication content transmitted by the transmitting device 110 is different from that generally used in conventional authenticated encryption with error correction function, but the receiving device 120 is capable of decrypting the message M while performing error correction and message authentication.

[0039] (Communication Method) Here, a communication method according to the first embodiment will be described. The communication method according to the first embodiment can be implemented in a communication system 100 including the above-described transmitting device 110 and receiving device 120. In the following, the transmitting method performed by the transmitting device 110 and the receiving method performed by the receiving device 120 will be described separately.

[0040] 4 is a flowchart showing an outline of the procedure of the transmission method according to the first embodiment. The transmission method according to the first embodiment is a method for transmitting a message M to the receiving device 120 by using a common key K shared with the receiving device 120, a pseudorandom function F, and a nonce N generated.

[0041] 4, in step S11, a message M and a nonce N are input. As already explained, the nonce N is a disposable random number, and for example, a counter can be used. In other words, the nonce N can be generated within the device without being input from the outside.

[0042] In step S12, a first error-correcting code R(M) is calculated from the message M, and a combination M||R(M) of the message M and the first error-correcting code R(M) is obtained. Again, the error correction method can be selected appropriately according to the communication method, but it is assumed to be a linear code.

[0043] In step S13, a ciphertext C is calculated from the combination M||R(M) of the message M and the first error correcting code R(M) obtained in step S12, using a nonce N. Using a random number obtained by inputting the nonce N to a pseudorandom function F, additive encryption is performed on the combination M||R(M) of the message M and the first error correcting code R(M).

[0044] On the other hand, in step S14, a second error correcting code R(N) is calculated from the nonce N. Also, in step S15, a message authentication tag T is calculated from the message M and the nonce N by using a common key K.

[0045] Finally, in step S16, the ciphertext C calculated as above, the message authentication tag T, the nonce N, and the second error correcting code R(N) are transmitted to the receiving device 120.

[0046] As can be seen from the above description, in the transmission method shown in Fig. 4, the processes in steps S12 and S13, the process in step S14, and the process in step S15 are parallelized. Therefore, in the transmission method shown in Fig. 4, delay is reduced from input of the message M to transmission of the ciphertext C, etc. to the receiving device 120. In addition, compared to the method of applying error correction codes generally used in conventional communication systems to the entire communication content, the amount of calculation and communication is reduced because error correction code processing is not performed on the message authentication tag T.

[0047] 5 is a flowchart showing an outline of the procedure of the receiving method according to the first embodiment. The receiving method according to the first embodiment is a method for decrypting a message from the ciphertext C', message authentication tag T', nonce N', and error correction code R(N)' received from the transmitting device 110, using a common key K and a pseudorandom function F shared with the transmitting device 110. As in the past, it is assumed that the received ciphertext C', message authentication tag T', nonce N', and error correction code R(N)' contain noise or tampering, and the ciphertext C, message authentication tag T, nonce N, and error correction code R(N) are distinguished from the ciphertext C, message authentication tag T, nonce N, and error correction code R(N) transmitted by the transmitting device 110 by adding "'".

[0048] As shown in Fig. 5, in step S21, ciphertext C', message authentication tag T', nonce N', and error correction code R(N)' of nonce N are received. Then, in step S22, error correction of nonce N' is performed using the error correction code R(N) of nonce N. If the error correction is successful (step S23; Y), the nonce N transmitted by the transmitting device 110 is decrypted. On the other hand, if the error correction is unsuccessful (step S23; N), it is determined that the correct communication content was not received, and the process is terminated.

[0049] Next, in step S24, the received ciphertext C' is decrypted using the error-corrected nonce N. The ciphertext C' is additively decrypted using a random number obtained by inputting the nonce N to a pseudorandom function F. Since the pseudorandom function F is shared between the transmitting device 110 and the receiving device 120, the same random number is generated for the same nonce N, and additive decryption of the ciphertext C' is performed using this random number. The result of decrypting the ciphertext C' is a concatenation M||R(M)' of the message M' and the first error-correcting code R(M)'.

[0050] Then, in step S25, the message M is decrypted by performing error correction to M∥R(M)'. As already explained, the received ciphertext C' can be considered as C'=C+e, which is the sum of the transmitted ciphertext C and the error vector e, and additively decoded this is M∥R(M)+e. Since the first error correcting code R(M) is coded using a linear code, if the error vector e can be corrected, the message M can be obtained. If the error correction is successful (step S26; Y), the message M transmitted by the transmitting device 110 is decrypted. On the other hand, if the error correction is unsuccessful (step S26; N), it is determined that the correct communication content was not received and the process is terminated.

[0051] Next, in step S27, a message authentication tag for verification T'' is calculated from the message M and nonce N decrypted using the common key K. This message authentication tag for verification T'' should match the message authentication tag T generated by the transmitting device 110 unless the message M (and nonce N) has been tampered with.

[0052] In step S28, the message authentication tag for verification T'' is compared with the received message authentication tag T' to determine whether they are within a predetermined range. If the difference between the message authentication tag for verification T'' and the received message authentication tag T' is within the predetermined range (step S28; Y), the decrypted message M is output in step S29. On the other hand, if the difference between the message authentication tag for verification T'' and the received message authentication tag T' is outside the predetermined range (step S28; N), it is determined that the correct communication content was not received and the process is terminated.

[0053] As already explained, the received message authentication tag T' does not necessarily match the message authentication tag T generated by the transmitting device 110, and the verification message authentication tag T'' may not match the received message authentication tag T' even if the message M has not been tampered with. Therefore, in step S28, if the difference between the verification message authentication tag T'' and the received message authentication tag T' is within a predetermined range, it is determined that no tampering has occurred.

[0054] As described above, the communication content transmitted by the transmitting device 110 is different from that generally used in conventional error-correcting authenticated encryption. However, the receiving method shown in FIG. 5 makes it possible to decrypt the message M while performing error correction and message authentication.

[0055] (Hardware configuration example) Fig. 6 is a diagram showing an example of a hardware configuration of an apparatus used in the embodiment. That is, the transmitting apparatus 110 and the receiving apparatus 120 are enabled to realize each function of the transmitting apparatus 110 and the receiving apparatus 120 by executing the above-described transmitting method or receiving method as a program in an information processing apparatus adopting the hardware configuration shown in Fig. 6. However, the hardware configuration example shown in Fig. 6 is an example of a hardware configuration for realizing each function of the transmitting apparatus 110 and the receiving apparatus 120, and is not intended to limit the hardware configuration of the transmitting apparatus 110 and the receiving apparatus 120. The transmitting apparatus 110 and the receiving apparatus 120 may include hardware not shown in Fig. 6.

[0056] As shown in FIG. 6, a hardware configuration 10 that may be adopted by the transmitting device 110 and the receiving device 120 includes a CPU (Central Processing Unit) 11, a main memory device 12, an auxiliary memory device 13, and an IF (Interface) section 14, which are interconnected, for example, by an internal bus.

[0057] The CPU 11 executes each command included in the program executed by the transmitting device 110 and the receiving device 120. The main storage device 12 is, for example, a RAM (Random Access Memory), and temporarily stores various programs such as the programs executed by the transmitting device 110 and the receiving device 120 for processing by the CPU 11.

[0058] The auxiliary storage device 13 is, for example, a hard disk drive (HDD), and is capable of storing various programs, such as the programs executed by the transmitting device 110 and the receiving device 120, for a medium to long term. The various programs, such as the programs, can be provided as a program product recorded on a non-transitory computer-readable storage medium.

[0059] The IF unit 14 provides an interface for communication between the transmitting device 110 and the receiving device 120, for example.

[0060] An information processing apparatus employing the above hardware configuration 10 realizes each function of the transmitting apparatus 110 and the receiving apparatus 120 by executing the above-mentioned transmitting method or receiving method as a program.

[0061] [Second embodiment] Next, a communication system according to the second embodiment will be described. As shown in FIG. 7, the communication system 200 is a system for transmitting a message from a transmitting device 210 to a receiving device 220 using authentication encryption with an error correction function. As shown in FIG. 7, the transmitting device 210 transmits a ciphertext C, a message authentication tag T, a nonce N, an error correction code R(N,A), and associated data to the receiving device 220. That is, in the communication system 200 according to the second embodiment, compared with the communication system 100 according to the first embodiment, associated data is added to the communication content transmitted from the transmitting device 210 to the receiving device 220. Here, the associated data is communication content that is transmitted as plain text without being encrypted, but is the subject of authentication that no tampering or the like has been performed. For example, the associated data includes a destination address and a protocol header. In addition, in the communication system 200 according to the second embodiment, the transmitting device 210 and the receiving device 220 share a common key K and a pseudorandom function F, similar to the communication system 100 according to the first embodiment.

[0062] Fig. 8 is a functional block diagram of a transmission device according to the second embodiment. As shown in Fig. 8, a transmission device 210 includes a first ECC unit 211, an ENC unit 212, a second ECC unit 213, a MAC unit 214, and a transmission unit 215.

[0063] The first ECC unit 211 calculates a first error correcting code R(M) from the message M, and outputs a concatenation M||R(M) of the message M and the first error correcting code R(M). The ENC unit 212 encrypts M||R(M) output from the first ECC unit 211 into a ciphertext C. This process is the same as in the first embodiment.

[0064] On the other hand, the second ECC unit 213 calculates a second error correcting code R(N,A) from the nonce N and the associated data A. Also, the MAC unit 214 calculates a message authentication tag T from the input of the message M, the nonce N, and the associated data A using a common key K.

[0065] Then, the transmitting unit 215 transmits the ciphertext C, the message authentication tag T, the nonce N, the second error correcting code R(N,A), and the associated data A calculated as described above to the receiving device 220. Note that in the transmitting device 210, similarly to the first embodiment, the processing in the first ECC unit 211 and the ENC unit 212, the processing in the second ECC unit 213, and the processing in the MAC unit 214 are parallelized.

[0066] 9 is a functional block diagram of a receiving device according to the second embodiment. The receiving device 220 decrypts a message M from the ciphertext C', message authentication tag T', nonce N', second error correcting code R(N,A)', and associated data A' received from the transmitting device 210. Here too, it is assumed that the ciphertext C', message authentication tag T', nonce N', second error correcting code R(N,A)', and associated data A' received from the transmitting device 210 contain noise or tampering, and by adding "'", they are distinguished from the ciphertext C, message authentication tag T, nonce N, second error correcting code R(N,A), and associated data A transmitted by the transmitting device 210.

[0067] As shown in FIG. 9, the receiving device 220 includes a second ECC decoding unit 221, a DEC unit 222, a first ECC decoding unit 223, a verification MAC unit 224, and an output unit 225.

[0068] The second ECC decoding unit 221 performs error correction on the nonce N' and the associated data A' using the second error correction code R(N, A)'. If the error correction is successful, the second ECC decoding unit 221 outputs the nonce N and the associated data A transmitted by the transmitting device 210. On the other hand, if the error correction is unsuccessful, the processing ends as it has not been possible to receive the communication contents correctly.

[0069] The DEC unit 222 decrypts the ciphertext C' received from the transmitting device 210, using the nonce N error-corrected by the second ECC decryption unit 221. Then, the first ECC decryption unit 223 decrypts the message M by correcting the error to M∥R(M)'. If the error correction fails, it is determined that the communication content could not be received correctly and the process ends.

[0070] The verification MAC unit 224 calculates a verification message authentication tag T'' using the common key K from the message M decrypted by the first ECC decryption unit 223 and the nonce N and associated data A decrypted by the second ECC decryption unit 221. Then, the output unit 225 compares the verification message authentication tag T'' with the message authentication tag T' received from the transmitting device 210, and outputs the message M obtained by the first ECC decryption unit 223 if they are within a predetermined range.

[0071] As described above, the receiving device 220 can decode the message M while performing error correction and message authentication even if the communication content transmitted by the transmitting device 210 includes associated data such as a destination address and a protocol header. In other words, the communication system according to the second embodiment can be applied to more realistic communication methods.

[0072] (Effect of reducing communication traffic) Here, the effect of reducing communication traffic in the communication system 200 according to the second embodiment will be illustrated. For example, consider that the message M, nonce N, message authentication tag T, and associated data A are all 64 bits in size, and that each of these elements undergoes error correction coding processing using SEC-DED (72,64). Here, SEC-DED is an abbreviation for Single Error Correction, Double Error Detection, and is an error correction coding process that makes it possible to detect up to two bits of error while correcting one bit of error. Note that (72,64) means that 8 bits are added to 64-bit data to convert it into a 72-bit code.

[0073] In this example, when error correction processing is performed on the entire communication content after conventional authentication encryption processing, 32 bits of overhead are generated. On the other hand, in the case of the communication system according to the second embodiment, the first ECC unit 211 generates 8 bits of overhead for the message M, and the second ECC unit 213 generates 8 bits of overhead each for the nonce N and associated data A (total of 16 bits), so that the total overhead generated by the first ECC unit 211 and the second ECC unit 213 is 24 bits. In other words, the communication system 200 according to the second embodiment can reduce overhead by 25% compared to the conventional method.

[0074] A part or all of the above-described embodiments can be described as, but is not limited to, the following supplementary notes. [Appendix 1] A communication system for transmitting a message from a transmitting device to a receiving device by using a common key and a pseudorandom function shared between the transmitting device and the receiving device, and a nonce generated by the transmitting device, comprising: The transmitting device a first ECC unit for calculating a first error correcting code from the message; an ENC unit that additively encrypts a combination of the message and the first error-correcting code using a random number obtained by inputting the nonce to the pseudorandom function, and outputs a ciphertext; a MAC unit for computing a message authentication tag for the message and the nonce using the common key; A second ECC unit that calculates a second error correcting code from the nonce; a transmission unit that transmits the ciphertext, the message authentication tag, the nonce, and the second error correction code to the receiving device; Equipped with The receiving device includes: A second ECC decoding unit that performs error correction on the nonce using the second error correcting code; a DEC unit that decrypts the message and the first error correcting code from the ciphertext by using a random number obtained by inputting the nonce to the pseudorandom function; a first ECC decoder that performs error correction on the message using the first error correcting code; a verification MAC unit that calculates a verification message authentication tag from the message output by the first ECC decoding unit and the nonce output by the second ECC decoding unit using the common key; an output unit that compares the verification message authentication tag with the message authentication tag, and outputs the message if the comparison result is within a predetermined range; A communication system comprising: [Appendix 2] The transmission unit further transmits related data to be subjected to tamper detection, the related data being transmitted in plain text; the second ECC unit combines the associated data with the nonce to calculate the second error correcting code; the MAC unit further calculates a message authentication tag including the associated data; The second ECC decoding unit corrects an error in the associated data by using the second error correcting code; The communication system of claim 1, wherein the verification MAC unit calculates the verification message authentication tag by including the associated data output by the second ECC decoding unit as an input. [Appendix 3] The communication system according to claim 1 or 2, wherein the comparison of the message authentication tag for verification with the message authentication tag uses a Hamming distance between the message authentication tag for verification and the message authentication tag being within a predetermined range. [Appendix 4] 4. The communication system of claim 1, wherein the first error correcting code is a linear code. [Appendix 5] A transmitting device that transmits a message to a receiving device by using a common key shared with the receiving device and a pseudorandom function and a nonce generated by the transmitting device, a first ECC unit for calculating a first error correcting code from the message; an ENC unit that additively encrypts a combination of the message and the first error-correcting code using a random number obtained by inputting the nonce to the pseudorandom function, and outputs a ciphertext; a MAC unit for computing a message authentication tag for the message and the nonce using the common key; A second ECC unit that calculates a second error correcting code from the nonce; a transmission unit that transmits the ciphertext, the message authentication tag, the nonce, and the second error correction code to the receiving device; A transmitting device comprising: [Appendix 6] A receiving device that decrypts a message from a ciphertext, a message authentication tag, a nonce, and a second error correcting code received from a transmitting device by using a common key and a pseudorandom function shared with the transmitting device, A second ECC decoding unit that performs error correction on the nonce using the second error correcting code; a decryption unit that decrypts the message and the first error-correcting code from the ciphertext using a random number obtained by inputting the nonce into the pseudorandom function; a first ECC decoder that performs error correction on the message using the first error correcting code; a verification MAC unit that calculates a verification message authentication tag from the message output by the first ECC decoding unit and the nonce output by the second ECC decoding unit using the common key; an output unit that compares the verification message authentication tag with the message authentication tag, and outputs the message if the comparison result is within a predetermined range; A communication system comprising: [Appendix 7] A communication method for transmitting a message from a transmitting device to a receiving device by using a common key and a pseudorandom function shared between the transmitting device and the receiving device, and a nonce generated by the transmitting device, comprising: The transmitting device, Computing a first error correcting code from the message; Additively encrypting a combination of the message and the first error-correcting code using a random number obtained by inputting the nonce into the pseudorandom function to output a ciphertext; Computing a message authentication tag over the message and the nonce using the common key; Computing a second error correcting code from the nonce; transmitting the ciphertext, the message authentication tag, the nonce, and the second error correcting code to the receiving device; The receiving device, correcting an error in the nonce using the second error correcting code; decrypting the message and the first error-correcting code from the ciphertext using a random number obtained by inputting the nonce into the pseudorandom function; error correcting the message using the first error correcting code; calculating a verification message authentication tag from the error-corrected message and the nonce using the common key; the verification message authentication tag is compared with the message authentication tag, and if the verification message authentication tag is within a predetermined range, the message is output. [Appendix 8] A method for transmitting a message to a receiving device by using a common key shared with the receiving device and a nonce generated using a pseudorandom function, comprising the steps of: Computing a first error correcting code from the message; Additively encrypting a combination of the message and the first error-correcting code using a random number obtained by inputting the nonce into the pseudorandom function to output a ciphertext; Computing a message authentication tag over the message and the nonce using the common key; Computing a second error correcting code from the nonce; A transmission method comprising transmitting the ciphertext, the message authentication tag, the nonce, and the second error correcting code to the receiving device. [Appendix 9] A receiving method for decrypting a message from a ciphertext, a message authentication tag, a nonce, and a second error correcting code received from a transmitting device, using a common key and a pseudorandom function shared with the transmitting device, comprising: correcting an error in the nonce using the second error correcting code; decrypting the message and the first error-correcting code from the ciphertext using a random number obtained by inputting the nonce into the pseudorandom function; error correcting the message using the first error correcting code; calculating a verification message authentication tag from the error-corrected message and the nonce using the common key; a receiving method comprising: comparing the verification message authentication tag with the message authentication tag; and outputting the message if the verification message authentication tag is within a predetermined range. [Appendix 10] A communication program for causing a process of transmitting a message from a transmitting device to a receiving device by using a common key and a pseudorandom function shared between a transmitting device and a receiving device, and a nonce generated by the transmitting device, the communication program comprising: The transmitting device, Computing a first error correcting code from the message; Additively encrypting a combination of the message and the first error-correcting code using a random number obtained by inputting the nonce into the pseudorandom function to output a ciphertext; Computing a message authentication tag over the message and the nonce using the common key; Computing a second error correcting code from the nonce; transmitting the ciphertext, the message authentication tag, the nonce, and the second error correction code to the receiving device; The receiving device includes: correcting an error in the nonce using the second error correcting code; decrypting the message and the first error-correcting code from the ciphertext using a random number obtained by inputting the nonce into the pseudorandom function; error correcting the message using the first error correcting code; calculating a verification message authentication tag from the error-corrected message and the nonce using the common key; a communication program for comparing the verification message authentication tag with the message authentication tag, and performing a process of outputting the message if the verification message authentication tag is within a predetermined range; [Appendix 11] A transmission program that causes a transmission device to perform a process of transmitting a message to a receiving device by using a common key shared with the receiving device, a pseudorandom function, and a generated nonce, the transmission program comprising: The transmitting device, Computing a first error correcting code from the message; Additively encrypting a combination of the message and the first error-correcting code using a random number obtained by inputting the nonce into the pseudorandom function to output a ciphertext; Computing a message authentication tag over the message and the nonce using the common key; Computing a second error correcting code from the nonce; a transmission program that transmits the ciphertext, the message authentication tag, the nonce, and the second error correcting code to the receiving device. [Appendix 12] A transmission program that causes a receiving device to perform a process of decrypting a message from a ciphertext, a message authentication tag, a nonce, and a second error correction code received from a transmitting device, using a common key and a pseudorandom function shared with the transmitting device, The receiving device correcting an error in the nonce using the second error correcting code; decrypting the message and the first error-correcting code from the ciphertext using a random number obtained by inputting the nonce into the pseudorandom function; error correcting the message using the first error correcting code; calculating a verification message authentication tag from the error-corrected message and the nonce using the common key; a receiving program for comparing the verification message authentication tag with the message authentication tag, and outputting the message if the verification message authentication tag is within a predetermined range;

[0075] The disclosures of the above cited patent documents are incorporated herein by reference. Within the scope of the entire disclosure of the present invention (including the scope of claims), modifications and adjustments of the embodiments and examples are possible based on the basic technical ideas. Furthermore, within the scope of the entire disclosure of the present invention, various combinations or selections (including partial deletions) of various disclosed elements (including each element of each claim, each element of each embodiment or example, each element of each drawing, etc.) are possible. In other words, the present invention naturally includes various modifications and corrections that a person skilled in the art would be able to make in accordance with the entire disclosure including the scope of claims and the technical ideas. In particular, with regard to the numerical ranges described in this specification, any numerical value or small range included in the range should be construed as being specifically described even if not otherwise specified. Furthermore, the disclosures of the above cited documents, if necessary, in accordance with the spirit of the present invention, may be used in part or in whole in combination with the disclosures of this specification as part of the disclosure of the present invention, and are deemed to be included in the disclosures of this application. [Explanation of symbols]

[0076] 10 Hardware Configuration 11 CPU 12 Main storage 13 Auxiliary storage device 14 IF Section 100,200 Communication Systems 110,210 Communication equipment 111,211 1st ECC Department 112,212 ENC section 113,213 2nd ECC Department 114,214 MAC section 115,215 Transmitter 120,220 Receiver 121,221 Second ECC Decoder 122,222 DEC Department 123,223 1st ECC Decoder 124,224 Verification MAC section 125,225 Output section

Claims

1. A communication system for transmitting a message from a transmitting device to a receiving device by using a common key and a pseudorandom function shared between the transmitting device and the receiving device, and a nonce generated by the transmitting device, comprising: The transmitting device a first ECC unit for calculating a first error correction code from the message; an ENC unit that performs additive encryption on a combination of the message and the first error-correcting code using a random number obtained by inputting the nonce to the pseudorandom function, and outputs a ciphertext; a MAC unit for calculating a message authentication tag for the message and the nonce using the common key; a second ECC unit that calculates a second error correction code from the nonce; a transmitting unit that transmits the ciphertext, the message authentication tag, the nonce, and the second error correction code to the receiving device; Equipped with The receiving device includes: a second ECC decoding unit that performs error correction on the nonce using the second error correcting code; a DEC unit that decodes the message and the first error correcting code from the ciphertext by using a random number obtained by inputting the nonce to the pseudorandom function; a first ECC decoder that performs error correction on the message using the first error correction code; a verification MAC unit that calculates a verification message authentication tag from the message output by the first ECC decoding unit and the nonce output by the second ECC decoding unit using the common key; an output unit that compares the verification message authentication tag with the message authentication tag, and outputs the message if the comparison result is within a predetermined range; A communication system comprising:

2. The transmission unit further transmits related data to be subjected to tamper detection, the related data being transmitted in plain text; the second ECC unit combines the associated data with the nonce to calculate the second error correction code; The MAC unit calculates a message authentication tag further including the associated data; The second ECC decoding unit corrects an error in the associated data by using the second error correcting code; The communication system according to claim 1 , wherein the verification MAC unit calculates the verification message authentication tag using the associated data output by the second ECC decoding unit as an input.

3. 3. The communication system according to claim 1, wherein the comparison between the message authentication tag for verification and the message authentication tag uses whether a Hamming distance between the message authentication tag for verification and the message authentication tag is within a predetermined range.

4. The communication system according to claim 1 , wherein the first error correcting code is a linear code.

5. A transmitting device that transmits a message to a receiving device by using a common key shared with the receiving device and a pseudorandom function and a nonce generated by the transmitting device, a first ECC unit for calculating a first error correction code from the message; an ENC unit that additively encrypts a combination of the message and the first error-correcting code using a random number obtained by inputting the nonce to the pseudorandom function, and outputs a ciphertext; a MAC unit for calculating a message authentication tag for the message and the nonce using the common key; a second ECC unit that calculates a second error correction code from the nonce; a transmitting unit that transmits the ciphertext, the message authentication tag, the nonce, and the second error correction code to the receiving device; A transmitting device comprising:

6. A receiving device that decrypts a message from a ciphertext, a message authentication tag, a nonce, and a second error correcting code received from a transmitting device by using a common key and a pseudorandom function shared with the transmitting device, a second ECC decoding unit that performs error correction on the nonce using the second error correcting code; a decryption unit that decrypts the message and the first error-correcting code from the ciphertext by using a random number obtained by inputting the nonce to the pseudorandom function; a first ECC decoder that performs error correction on the message using the first error correction code; a verification MAC unit that calculates a verification message authentication tag using the common key from the message output by the first ECC decoding unit and the nonce output by the second ECC decoding unit; an output unit that compares the verification message authentication tag with the message authentication tag, and outputs the message if the comparison result is within a predetermined range; A receiving device comprising:

7. A communication method for transmitting a message from a transmitting device to a receiving device by using a common key and a pseudorandom function shared between the transmitting device and the receiving device, and a nonce generated by the transmitting device, comprising: The transmitting device, Computing a first error correcting code from the message; Additively encrypting a combination of the message and the first error-correcting code using a random number obtained by inputting the nonce into the pseudorandom function to output a ciphertext; Computing a message authentication tag over the message and the nonce using the common key; Computing a second error correcting code from the nonce; transmitting the ciphertext, the message authentication tag, the nonce, and the second error correction code to the receiving device; The receiving device, error correcting the nonce using the second error correcting code; decrypting the message and the first error-correcting code from the ciphertext using a random number obtained by inputting the nonce into the pseudorandom function; error correcting the message using the first error correcting code; calculating a verification message authentication tag from the error-corrected message and the nonce using the common key; the verification message authentication tag is compared with the message authentication tag, and if the verification message authentication tag is within a predetermined range, the message is output.

8. A method for transmitting a message to a receiving device by using a common key shared with the receiving device and a nonce generated using a pseudorandom function, comprising the steps of: Computing a first error correcting code from the message; Additively encrypting a combination of the message and the first error-correcting code using a random number obtained by inputting the nonce into the pseudorandom function to output a ciphertext; Computing a message authentication tag over the message and the nonce using the common key; Computing a second error correcting code from the nonce; A transmission method for transmitting the ciphertext, the message authentication tag, the nonce, and the second error correction code to the receiving device.

9. A receiving method for decrypting a message from a ciphertext, a message authentication tag, a nonce, and a second error correcting code received from a transmitting device, using a common key and a pseudorandom function shared with the transmitting device, the method comprising: error correcting the nonce using the second error correcting code; decrypting the message and the first error-correcting code from the ciphertext using a random number obtained by inputting the nonce into the pseudorandom function; error correcting the message using the first error correcting code; calculating a verification message authentication tag from the error-corrected message and the nonce using the common key; A receiving method comprising: comparing the verification message authentication tag with the message authentication tag; and outputting the message if the verification message authentication tag is within a predetermined range.

10. A communication program for causing a process of transmitting a message from a transmitting device to a receiving device by using a common key and a pseudorandom function shared between a transmitting device and a receiving device, and a nonce generated by the transmitting device, the communication program comprising: The transmitting device, Computing a first error correcting code from the message; Additively encrypting a combination of the message and the first error-correcting code using a random number obtained by inputting the nonce into the pseudorandom function to output a ciphertext; Computing a message authentication tag over the message and the nonce using the common key; Computing a second error correcting code from the nonce; transmitting the ciphertext, the message authentication tag, the nonce, and the second error correction code to the receiving device; The receiving device, error correcting the nonce using the second error correcting code; decrypting the message and the first error-correcting code from the ciphertext using a random number obtained by inputting the nonce into the pseudorandom function; error correcting the message using the first error correcting code; calculating a verification message authentication tag from the error-corrected message and the nonce using the common key; a communication program for comparing the verification message authentication tag with the message authentication tag, and performing a process of outputting the message if the verification message authentication tag is within a predetermined range;

11. A transmission program that causes a transmitting device to perform a process of transmitting a message to a receiving device by using a common key shared with the receiving device, a pseudorandom function, and a generated nonce, the transmitting device comprising: The transmitting device, Computing a first error correcting code from the message; Additively encrypting a combination of the message and the first error-correcting code using a random number obtained by inputting the nonce into the pseudorandom function to output a ciphertext; Computing a message authentication tag over the message and the nonce using the common key; Computing a second error correcting code from the nonce; a transmission program for transmitting the ciphertext, the message authentication tag, the nonce, and the second error correction code to the receiving device.

12. A transmission program that causes a receiving device to perform a process of decrypting a message from a ciphertext, a message authentication tag, a nonce, and a second error correction code received from a transmitting device, using a common key and a pseudorandom function shared with the transmitting device, The receiving device error correcting the nonce using the second error correcting code; decrypting the message and the first error-correcting code from the ciphertext using a random number obtained by inputting the nonce into the pseudorandom function; error correcting the message using the first error correcting code; calculating a verification message authentication tag from the error-corrected message and the nonce using the common key; a receiving program for comparing the verification message authentication tag with the message authentication tag, and outputting the message if the verification message authentication tag is within a predetermined range;

Images