AUTHENTICATION KEY EXCHANGE SYSTEM, DEVICE, AUTHENTICATION KEY EXCHANGE METHOD, AND PROGRAM

Abstract

To provide an ID-based authentication key exchange (AKE) protocol with invalidation function of which the time required for key update information generation does not depend on the number of users and which does not require pairing calculation.SOLUTION: In an AKE system comprising a key generation device and a plurality of apparatuses, the key generation device outputs a master private key, a master public key and an initial invalid person list from a security parameter and a total number of apparatuses, outputs a static private key from the master private key, the master public key and identifiers of apparatuses, updates the invalid person list at the present time, and outputs key update information at the present time. The plurality of apparatuses outputs a latest private key at the present time without using pairing calculation from the master public key, the static private key corresponding to the apparatus per se and the key update information at the present time, outputs a temporary private key and a temporary public key from the master public key and the latest private key and outputs a session key to be shared with a communication partner from the master public key, identifiers of the apparatus per se and the communication partner, the latest private key corresponding to the apparatus per se and temporary public key corresponding to the apparatus per se and the communication partner.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an authentication key exchange system, an apparatus, Authentication Key Exchange The present invention relates to a method and a program. [Background technology]

[0002] The Authenticated Key Exchange (AKE) protocol is a protocol for each user to secretly and reliably generate a common session key with a communication partner based on his / her own private key. There are PKI (Public Key Infrastructure)-based AKE protocols that use electronic certificates, as well as ID-based AKE protocols that use IDs (e.g., serial number of a device) as public keys. Compared with the PKI-based AKE protocol, the ID-based AKE protocol has the advantage that it is not necessary to verify the binding between the communication partner and the public key.

[0003] In addition, the AKE protocol requires a user revocation function from the viewpoint of long-term operation. In the case of a PKI-based protocol, the validity and revocation of a certificate can be confirmed by the validity period written in the certificate, but in the case of an ID-based protocol, each user only knows the ID of the communication partner, and therefore there is no way to confirm whether the ID or private key of the communication partner has been revoked. For this reason, in the existing ID-based AKE protocol (for example, Non-Patent Document 1), a key generation center (KGC) distributes key update information to each user at regular intervals, and only valid users can obtain the latest private key from their own private key and the key update information, thereby realizing the user revocation function. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Tung-Tso Tsai, Yun-Hsin Chuang, Yuh-Min Tseng, Sen-Shan Huang, Ying-Hao Hung. "A Leakage-Resilient ID-Based Authenticated Key Exchange Protocol With a Revocation Mechanism", 2021. Summary of the Invention [Problem to be solved by the invention]

[0005] However, existing ID-based AKE protocols with revocation function have problems in that the time required to generate key update information is linear with respect to the number of users, and the computational cost is high because pairing calculations are required.

[0006] For large-scale operation, it is necessary to reduce the time required to generate key update information, and since ID-based key exchange is expected to be applied on devices with relatively small computational resources such as IoT devices, it is desirable to be able to execute the protocol with low computational cost. For this reason, it is necessary to realize an ID-based AKE protocol with a revocation function in which the time required to generate key update information does not depend on the number of users and does not require pairing calculations.

[0007] One embodiment of the present invention has been made in consideration of the above points, and aims to realize an ID-based AKE protocol with a revocation function in which the time required to generate key update information does not depend on the number of users and does not require pairing calculations. [Means for solving the problem]

[0008] In order to achieve the above object, an authentication key exchange system according to one embodiment is an authentication key exchange system including a key generation device and a plurality of devices, the key generation device generating a security parameter 1 λand the total number N of the devices, and outputting a master private key MSK, a master public key MPK, and an initial revoked user list RL; and ID a static private key generation unit configured to receive the master public key MPK and a new revoked user list RL as input, increment the current time T, and generate the revoked user list RL at the current time T; T a revocation list update unit configured to update the revocation list RL to the master private key MSK, the master public key MPK, the current time T, and the revocation list RL using a KUNode algorithm to generate key update information ku at the current time T. T and a key update information generating unit configured to output the master public key MPK and a static private key ssk corresponding to its own identifier ID. ID and the key update information ku at the current time T T Using the input, the latest secret key csk at the current time T is obtained without using pairing calculation. ID,T and a latest private key csk corresponding to the master public key MPK and its own identifier ID at the current time T. ID,T With input, temporary private key esk ID and the ephemeral public key epk ID a temporary key generation unit configured to output the master public key MPK, the identifier ID of the communication partner, the latest private key csk corresponding to the identifier ID of the communication partner at the current time T, and ID,T and a temporary private key esk corresponding to your identifier ID ID and the temporary public key epk corresponding to the communication partner's identifier ID' ID' and a session key generating unit configured to receive as input the above-mentioned ID and output a session key SK to be shared with the communication partner. Effect of the Invention

[0009] It is possible to realize an ID-based AKE protocol with revocation function in which the time required to generate key update information does not depend on the number of users and pairing calculation is not required. [Brief description of the drawings]

[0010] [Figure 1] 1 is a diagram illustrating an example of an overall configuration of an ID-based authentication key exchange system according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a diagram illustrating an example of a functional configuration of a key generating device according to the present embodiment. [Diagram 3] FIG. 2 is a diagram illustrating an example of a functional configuration of an apparatus according to the present embodiment. [Figure 4] FIG. 11 is a sequence diagram showing a flow from parameter generation to static secret key generation in an embodiment. [Diagram 5] 11 is a sequence diagram showing a flow from updating a revocation list to generating a latest private key in an embodiment. FIG. [Figure 6] FIG. 11 is a sequence diagram showing a flow from temporary key generation to session key generation in one embodiment. [Figure 7] FIG. 2 illustrates an example of a hardware configuration of a computer. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] An embodiment of the present invention will be described below. In the embodiment described below, an ID-based authentication key exchange system 1 that realizes an ID-based AKE protocol with a revocation function in which the time required to generate key update information does not depend on the number of users and does not require pairing calculations will be described.

[0012] <Preparation> First, before describing this embodiment, some symbols, concepts, algorithms, etc. will be prepared.

[0013] Let λ be a security parameter, q be a prime power of some magnitude, and Z q :=Z / qZ. Also, {0,1} * Let {0,1} be a binary sequence of any length.λ Let be a binary sequence of length λ bits, and || represents the concatenation of bit strings.

[0014] <KUNode Algorithm> Many existing ID-based encryption systems with revocation functions (e.g., References 1 to 3) use binary trees and the KUNode algorithm to reduce the time required to generate key update information.

[0015] Let BT be a binary tree with leaves that are linked to each user's ID, RL be a list of leaves that are linked to the IDs of revoked users, root be the root of the binary tree BT, Path(ID) be the set of nodes included in the path from the leaves that are linked to the IDs to the root, and x left Let x be the left child node of node x, right Let be the right child node of node x.

[0016] At this time, the KUNode algorithm consists of the following steps 1 to 5: Step 1:Let X = φ, Y = φ.

[0017] Step 2: For each ID ∈ RL, add Path(ID) to X.

[0018] Step 3: For each x∈X, x left If is not included in X, then x left Add to Y and x right If is not included in X, then x right Add to Y.

[0019] Step 4: If Y=φ, add root to Y.

[0020] Step 5: Output Y.

[0021] <ID-based AKE protocol with revocation function> The ID-based AKE protocol with revocation function consists of the following seven probabilistic polynomial-time (PPT) algorithms. Note that the ephemeral key generation algorithm EKGen and the session key generation algorithm SKGen are symmetric algorithms between the initiator and the responder. In the following, the initiator uses the identifier ID A , the responder has identifier ID B The algorithm on the initiator side will be described assuming that each of the two has the above.

[0022] ·ParGen(1 λ ,N) → (MSK,MPK,RL) 1 bit string of security parameter λ length 1 λ (This one λ are also sometimes called security parameters. It is a parameter generation algorithm that takes as input the master secret key MSK, the master public key MPK, and the initial revoked list RL, and the number of users N. The parameter generation algorithm ParGen is executed only once by the KGC. Note that all of the following algorithms also take the master public key MPK as input, but for simplicity, the master public key MPK will be omitted below.

[0023] ·SSKGen(MSK,ID) →ssk ID Using the master secret key MSK and the user's identifier ID as input, a static secret key ssk corresponding to the ID is generated. ID The static secret key generation algorithm SSKGen is executed once for each user by the KGC.

[0024] ·Revoke(RL) This is a revocation list update algorithm that takes a new revocation list RL as input, increments time T, and updates the revocation list at time T. The revocation list update algorithm Revoke is executed by KGC at regular intervals. The revocation list is a list of revoked identifiers ID.

[0025] ·KeyUp(MSK,T,RL)→ku T Using the master secret key MSK, time T, and the revocation list RL at that time as input, key update information ku T The key update information generation algorithm KeyUp is executed periodically by the KGC.

[0026] ·CSKGen(ssk ID ,ku T ) → csk ID,T static private key ssk ID and key update information T With and as input, the latest private key csk ID,T The latest private key generation algorithm CSKGen outputs ⊥ or ⊥. The latest private key generation algorithm CSKGen is executed by the user at regular intervals. Note that ⊥ means that the ID has expired.

[0027] · EKGen (ID A ,ID B ,T,csk A,T )→(esk A ,epk A ) User Identifier ID A and the identifier ID of the user's communication partner B and the current time T and the latest secret key csk of that user at time T A,T Using the input, the temporary secret key esk of the user in the session with the communication partner is calculated. A and the temporary public key epk A The ephemeral key generation algorithm EKGen is run by the user for each session.

[0028] ·SKGen (ID A ,ID B ,T,csk A,T ,esk A ,epk B ) →SK User Identifier ID A and the ID of the user's communication partner Band the current time T and the latest secret key csk of that user at time T A,T and the user's temporary private key esk A and the communication partner's temporary public key epk B The session key generation algorithm SKGen takes as input the ID and outputs a session key SK. The session key generation algorithm SKGen is executed by the user for each session.

[0029] Note that the ephemeral key generation algorithm EKGen and the session key generation algorithm SKGen may be different between the initiator and the responder of a session.

[0030] In this embodiment, as described later, the key update information generation algorithm KeyUp is configured using the KUNode algorithm. This makes it possible to reduce the time required to generate key update information. Also, as described later, the latest private key generation algorithm CSKGen is configured using a signature called a Schnorr signature. This makes it possible to eliminate the need for pairing calculations.

[0031] Schnorr signature is an ID-based signature that does not use pairing calculations internally. More specifically, each user uses a value obtained by adding his / her own static private key and key update information associated with him / her as a signing key, and generates a signature for a text (plain text) containing information on an identifier ID and time T, and this is the latest private key. Due to the nature of the signature, this latest private key cannot be generated without the signing key, and therefore only a user who has the correct static private key and key update information can obtain its value. In addition, by utilizing the property that a set of a correct signature, plain text, and public key satisfies a certain equation, the same value can be calculated as a session key between users who have the correct latest private key.

[0032] <Overall configuration example> Next, an example of the overall configuration of the ID-based authentication key exchange system 1 according to this embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram showing an example of the overall configuration of the ID-based authentication key exchange system 1 according to this embodiment.

[0033] 1, an ID-based authentication key exchange system 1 according to this embodiment includes a key generation device 10 and a plurality of devices 20. The key generation device 10 and each device 20 are communicatively connected via a communication network 30. Similarly, each device 20 is communicatively connected to each other via the communication network 30.

[0034] The key generation device 10 is a computer or computer system that functions as a key generation center (KGC). The key generation device 10 executes a parameter generation algorithm ParGen, a static secret key generation algorithm SSKGen, a revoked party list update algorithm Revoke, and a key update information generation algorithm KeyUp.

[0035] The device 20 is a computer or computer system that performs authenticated key exchange with other devices 20. The device 20 executes a current secret key generation algorithm CSKGen, an ephemeral key generation algorithm EKGen, and a session key generation algorithm SKGen.

[0036] As the device 20, various terminals, devices, equipment, etc., such as an IoT device, a smartphone, a tablet terminal, a PC (personal computer), a wearable device, an industrial device, an edge computer, a general-purpose server, etc., can be used. For example, when applied to a system that collects data from various IoT devices, the device 20 on the initiator side may be an IoT device, and the device 20 on the responder side may be an edge computer, etc.

[0037] Hereinafter, when the devices 20 are to be distinguished from one another, they will be referred to as "device 20A," "device 20B," etc. In addition, the identifier ID of the device 20A will be referred to as "ID A ” and the identifier ID of the device 20B is “ID B", the device 20A is the initiator, and the device 20B is the responder. As the identifier ID, in addition to a manufacturing unique number, for example, a MAC (Media Access Control address) address, an IP (Internet Protocol) address, a user ID, an email address, a telephone number, etc. can be used.

[0038] <Example of functional configuration> Next, examples of the functional configuration of the key generation device 10 and the device 20 according to this embodiment will be described with reference to Fig. 2 and Fig. 3, respectively. Fig. 2 is a diagram showing an example of the functional configuration of the key generation device 10 according to this embodiment. Fig. 3 is a diagram showing an example of the functional configuration of the device 20 according to this embodiment.

[0039] ≪Key generation device 10≫ 2, the key generation device 10 according to this embodiment includes a parameter generation unit 101, a private key generation unit 102, a list update unit 103, a key update information generation unit 104, and a communication unit 105. Each of these units is realized, for example, by a process executed by a processor such as a CPU (Central Processing Unit) or the like of one or more programs installed in the key generation device 10. The key generation device 10 according to this embodiment also includes a storage unit 106. The storage unit 106 is realized, for example, by a storage device such as an HDD (Hard Disk Drive) or an SSD (Solid State Drive).

[0040] The parameter generation unit 101 executes a parameter generation algorithm ParGen. The private key generation unit 102 executes a static private key generation algorithm SSKGen. The list update unit 103 executes a revoked party list update algorithm Revoke. The key update information generation unit 104 executes a key update information generation algorithm KeyUp. The communication unit 105 performs various communications with the device 20, etc. The storage unit 106 stores various data, the results of various algorithms, intermediate calculation results, etc.

[0041] ≪Equipment 20≫ 3, device 20 according to this embodiment includes a key update unit 201, a temporary key generation unit 202, a session key generation unit 203, and a communication unit 204. Each of these units is realized, for example, by a process in which one or more programs installed in device 20 are executed by a processor such as a CPU. Device 20 according to this embodiment also includes a storage unit 205. Storage unit 205 is realized, for example, by a storage device such as an HDD, an SSD, or a flash memory.

[0042] The key update unit 201 executes a latest secret key generation algorithm CSKGen. The temporary key generation unit 202 executes a temporary key generation algorithm EKGen. The session key generation unit 203 executes a session key generation algorithm SKGen. The communication unit 204 performs various communications between the key generation device 10 and other devices 20. The storage unit 205 stores various data, the results of various algorithms, intermediate calculation results, and the like.

[0043] <Example 1> The first embodiment will be described below.

[0044] In this embodiment, each algorithm of the ID-based AKE protocol with revocation function is configured as follows. In this embodiment, the ephemeral key generation algorithm EKGen is the latest secret key csk ID,T In addition, since the ephemeral key generation algorithm EKGen and the session key generation algorithm SKGen are symmetric algorithms between the initiator and the responder, the following describes the algorithm of device 20A on the initiator side with regard to the session key generation algorithm SKGen.

[0045] ·ParGen(1 λ ,N) → (MSK,MPK,RL) Step 1-1: Let q be a function whose size is O(2 λ ) to a prime power, G be a cyclic group of order q, and g be a generator of G.

[0046] Step 1-2: x∈ U Z qSelect y=g x Let us assume that.

[0047] Step 1-3: BT is a binary tree with N leaves, and the ID of each device 20 is linked to each leaf.

[0048] Step 1-4: Two hash functions H1: {0, 1} * ×G→Z q and H2: G×G→{0,1} λ Prepare the following.

[0049] Step 1-5: Output MSK = x, MPK = (q, G, g, y, BT, H1, H2), RL = φ.

[0050] Note that in all of the following algorithms, the master public key MPK is also used as an input, but is omitted here.

[0051] ·SSKGen(MSK,ID) →ssk ID Step 2-1: k∈ U Z q Select r ID =g k Let us assume that.

[0052] Step 2-2:s ID =k+xH1(ID,r ID )

[0053] Step 2-3: ssk ID =(s ID ,r ID ) to output.

[0054] In addition,

[0055]

number

[0056] ·KeyUp(MSK,T,RL)→ku T Step 3-1: For each θ∈KUNode(BT,RL), (s T||θ ,r T||θ ) ← SSKGen(MSK,T||θ).

[0057] Step 3-2:ku T = {(θ,s T||θ ,r T||θ )} θ∈KUNode(BT,RL) The output is as follows:

[0058] ·CSKGen(ssk ID ,ku T ) → csk ID,T Step 4-1: Select θ∈KUNode(BT,RL)∩Path(ID). If such θ does not exist, output ⊥.

[0059] Step 4-2: k∈ U Z q Select r ID,T =g k Let us assume that.

[0060] Step 4-3:s ID,T =k+(s ID +s T||θ )H1(ID||T,r ID,T )

[0061] Step 4-4: csk ID,T =(s ID,T ,r ID,T ,r ID ,r T||θ ,θ).

[0062] ·EKGen(csk ID,T )→(esk ID ,epk ID ) Step 5-1:v ID ∈ U Z q Select and press w ID =g v_ID However, "v_ID" is v ID Represents.

[0063] Step 5-2:esk ID =v ID , epk ID =(w ID ,r ID ,r T||θ ,r ID,T ,θ).

[0064] ·SKGen (ID A ,ID B ,T,csk A,T ,esk A ,epk B ) →SK Step 6-1: Calculate Z1 as follows:

[0065]

number

[0066] ·Revoke(RL) Step 7-1: Revocation list RL at current time T T If is not included in RL, output ⊥.

[0067] Step 7-2:RL T If ⊆RL, then T←T+1, and RL T ←Update with RL.

[0068] In the above step 6-2, for example, the master public key MPK, the IDs of both the initiator and the responder, and the time T may be added as inputs to the hash function H2 when generating the session key SK. Specifically, for example, SK=H2(Z1,Z2,MPK,ID A ,ID B , T), and various other information can be used as the input to the hash function H2.

[0069] <<Flow from parameter generation to static private key generation>> An example of a flow from parameter generation to static private key generation will be described with reference to Fig. 4. Note that Fig. 4 is executed once, for example, at the time of system setup.

[0070] The parameter generation unit 101 of the key generation device 10 λ , N) are executed (step S101). As a result, a master secret key MSK, a master public key MPK, and an initial revoked party list RL are obtained. Note that the master public key MPK is made public to each device 20.

[0071] The private key generation unit 102 of the key generation device 10 executes a static private key generation algorithm SSKGen(MSK, ID) (step S102). A and device 20A having identifier ID B If the device 20B exists, the private key generation unit 102 of the key generation device 10 generates SSKGen(MSK, ID A ) and SSKGen(MSK,ID B ) are executed respectively. As a result, the static private key ssk of the device 20A is A and the static private key ssk of device 20B B In the following, the static private key ssk A and the static private key ssk B In the following explanation, it is assumed that the above has been obtained. Note that the identifier ID is public information.

[0072] The communication unit 105 of the key generating device 10 receives the static secret key ssk A to the device 20A (step S103). B The static secret key ssk is transmitted to the device 20B (step S104). ID is transmitted to the device 20 via a secure communication path. Alternatively, for example, it may be transmitted to the device 20 via an external recording medium, or may be transmitted to the device 20 via a direct wired connection to the key generation device 10.

[0073] <<Flow from updating the revocation list to generating the latest private key>> An example of the flow from updating the revocation list to generating the latest private key will be described with reference to Fig. 5. Note that Fig. 5 is executed repeatedly at regular intervals, for example. Also, it is assumed that a new revoked party list RL is obtained before Fig. 5 starts.

[0074] The list update unit 103 of the key generating device 10 executes the revoked party list update algorithm Revoke(RL) (step S201). As a result, the current time T is incremented and the current revoked party list RL T will be updated.

[0075] The key update information generating unit 104 of the key generating device 10 executes the key update information generating algorithm KeyUp(MSK, T, RL) (step S202). T is obtained.

[0076] The communication unit 105 of the key generation device 10 receives the key update information ku T In the same manner, the communication unit 105 of the key generating device 10 transmits the key update information ku to the device 20A (step S203). T to the device 20B (step S204).

[0077] The key update unit 201 of the device 20A updates the latest secret key generation algorithm CSKGen(ssk A ,ku T ) (step S205). As a result, the latest secret key csk of the device 20A is A,T Similarly, the key update unit 201 of the device 20B obtains the latest secret key generation algorithm CSKGen(ssk B ,ku T ) (step S206). As a result, the latest secret key csk of the device 20B is B,T is obtained.

[0078] <<Flow from temporary key generation to session key generation>> An example of the flow from temporary key generation to session key generation will be described with reference to Fig. 6. Note that Fig. 6 is executed when a session is started between device 20A and device 20B, for example.

[0079] The temporary key generation unit 202 of the device 20A uses a temporary key generation algorithm EKGen(csk A,T ) (step S301). This results in the temporary secret key esk A and the ephemeral public key epk A is obtained.

[0080] The communication unit 105 of the device 20A receives its own identifier ID A and the ephemeral public key epk A to the device 20B (step S302).

[0081] The temporary key generation unit 202 of the device 20B uses a temporary key generation algorithm EKGen(csk B,T ) (step S303). This results in the temporary secret key esk B and the ephemeral public key epk B is obtained.

[0082] The communication unit 105 of the device 20B receives its own identifier ID B and the ephemeral public key epk B to the device 20A (step S304).

[0083] The session key generating unit 203 of the device 20A generates a session key using a session key generation algorithm SKGen(ID A ,ID B ,T,csk A,T ,esk A ,epk B ) (step S305). As a result, the session key SK is obtained.

[0084] The session key generating unit 203 of the device 20B generates a session key using a session key generation algorithm SKGen(ID B ,ID A ,T,csk B,T ,esk B ,epkA ) (step S306). As a result, the session key SK is obtained.

[0085] <Example 2> The second embodiment will now be described.

[0086] In this embodiment, the configurations of the latest secret key generation algorithm CSKGen, the ephemeral key generation algorithm EKGen, and the session key generation algorithm SKGen are changed among the algorithms of the ID-based AKE protocol with revocation function described in embodiment 1. Since other points are the same as in embodiment 1, only the changes will be described below.

[0087] ·CSKGen(ssk ID ,ku T ) → csk ID,T Step 4'-1: Select θ∈KUNode(BT,RL)∩Path(ID). If such a θ does not exist, output ⊥.

[0088] Step 4'-2: k∈ U Z q Select r ID,T =g k Let us assume that.

[0089] Step 4'-3: α, β∈ U Z q Select .

[0090] Step 4'-4:s ID,T =k+(α s ID +β s T||θ )H1(ID||T,r ID,T )

[0091] Step 4'-5: csk ID,T =(s ID,T ,r ID,T ,r ID ,r T||θ ,r ID α ,r T||θ β ,y α ,yβ ,θ).

[0092] ·EKGen(csk ID,T )→(esk ID ,epk ID ) Step 5'-1:v ID ∈ U Z q Select and press w ID =g v_ID However, "v_ID" is v ID Represents.

[0093] Step 5'-2:esk ID =v ID , epk ID =(w ID ,r ID ,r T||θ ,r ID,T ,r ID α ,r T||θ β ,y α ,y β ,θ).

[0094] ·SKGen (ID A ,ID B ,T,csk A,T ,esk A ,epk B ) →SK Step 6'-1: Calculate Z1 as follows:

[0095]

number

[0096] The essential difference between this embodiment and the first embodiment is the fourth step (step 4-4 and step 4'-4) of the latest secret key generation algorithm CSKGen. ID ands T||θThe Schnorr signature is executed using the sum of s as the signature key. ID ands T||θ The signing key is a linear combination of these.

[0097] <Hardware configuration example> The key generating device 10 and the device 20 according to this embodiment are realized, for example, by the hardware configuration of a computer 500 as shown in Fig. 7. Fig. 7 is a diagram showing an example of the hardware configuration of the computer 500.

[0098] 7 includes an input device 501, a display device 502, an external I / F 503, a communication I / F 504, a processor 505, and a memory device 506. Each of these pieces of hardware is connected to each other via a bus 507 so as to be able to communicate with each other.

[0099] The input device 501 is, for example, a keyboard, a mouse, a touch panel, various physical buttons, a switch, etc. The display device 502 is, for example, a display, a display panel, etc. Note that the computer 500 does not necessarily have to have at least one of the input device 501 and the display device 502, for example.

[0100] The external I / F 503 is an interface with an external device such as a recording medium 503a. Examples of the recording medium 503a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0101] The communication I / F 504 is an interface for connecting to a communication network. The processor 505 is a variety of arithmetic devices such as a CPU, etc. The memory device 506 is a variety of storage devices such as an HDD, an SSD, a RAM (Random Access Memory), a ROM (Read Only Memory), a flash memory, etc.

[0102] The key generation device 10 and the device 20 according to this embodiment can be realized, for example, by a hardware configuration of a computer 500 as shown in Fig. 7. However, it goes without saying that the hardware configuration of the computer 500 shown in Fig. 7 is only an example. The computer 500 shown in Fig. 7 may have, for example, multiple processors 505, multiple memory devices 506, or various hardware not shown.

[0103] <Summary> As described above, the ID-based authentication key exchange system 1 according to this embodiment uses the KUNode algorithm to realize the key update information generation algorithm KeyUp of the ID-based AKE protocol with revocation function. This makes it possible to generate key update information efficiently even in large-scale operations because the time required to generate key update information does not depend on the number of users.

[0104] Moreover, the ID-based authentication key exchange system 1 according to this embodiment realizes the latest private key generation algorithm CSKGen of the ID-based AKE protocol with revocation function by using Schnorr signature. This makes it possible to generate the latest private key by calculations with relatively low computational cost (such as scalar multiplication or multiplication on a group) without using pairing calculations.

[0105] Therefore, according to the ID-based authentication key exchange system 1 of this embodiment, it is possible to realize an ID-based AKE protocol with a revocation function in which the time required to generate key update information does not depend on the number of users and which does not require pairing calculations.

[0106] The present invention is not limited to the above-described embodiments specifically disclosed, and various modifications, changes, combinations with known technologies, etc. are possible without departing from the scope of the claims.

[0107] [References] Reference 1: Alexandra Boldyreva, Vipul Goyal, Virendra Kumar. "Identity-Based Encryption with Efficient Revocation", 2008. Reference 2: Jae Hong Seo and Keita Emura. "Revocable Identity-Based Encryption Revisited: Security Model and Construction", 2013. Reference 3: Xuecheng Ma and Dongdai Lin. "A Generic Construction of Revocable Identity-Based Encryption", 2019. [Explanation of symbols]

[0108] 1. ID-based Authenticated Key Exchange System 10 Key generator 20 equipment 30 Communication Network 101 Parameter Generation Unit 102 Private key generation section 103 List Update Department 104 Key update information generation unit 105 Communications Department 106 Storage section 201 Key update section 202 Temporary key generation unit 203 Session Key Generation Unit 204 Communications Department 205 Storage section

Claims

1. An authentication key exchange system including a key generation device and a plurality of devices, The key generating device includes: Security Parameter 1 λ and the total number N of devices, and outputting a master private key MSK, a master public key MPK, and an initial revoked party list RL; The master secret key MSK, the master public key MPK, and the identifier ID of the device are input, and a static secret key ssk corresponding to the identifier ID is ＩＤ a static private key generator configured to output a The master public key MPK and the new revoked list RL are input, the current time T is incremented, and the revoked list RL at the current time T is Ｔ a revoked party list update unit configured to update the revoked party list RL to the new revoked party list RL; The master private key MSK, the master public key MPK, the current time T, and the revoked user list RLT at the current time T are input, and key update information ku at the current time T is generated using the KUNode algorithm. Ｔ and a key update information generator configured to output The device comprises: The master public key MPK and a static private key ssk corresponding to its own identifier ID ＩＤ and the key update information ku at the current time T Ｔ Using the input, the latest secret key csk at the current time T is obtained using Schnorr signature without using pairing calculation. ＩＤ，Ｔ a latest private key generator configured to output a latest private key; The master public key MPK and the latest private key csk corresponding to its own identifier ID at the current time T ＩＤ，Ｔ With input, temporary private key esk ＩＤ and the temporary public key epk ＩＤ a temporary key generator configured to output a temporary key; The master public key MPK, the user's own identifier ID, the communication partner's identifier ID', and the latest secret key csk corresponding to the user's own identifier ID at the current time T ＩＤ，Ｔ and a temporary private key esk corresponding to the identifier ID ＩＤ and a temporary public key epk corresponding to the identifier ID′ of the communication partner ＩＤ' a session key generating unit configured to receive the above-mentioned input and output a session key SK to be shared with the communication partner; An authenticated key exchange system having

2. The latest private key generation unit The static secret key ssk ＩＤ The value s contained in ＩＤ and the key update information ku Ｔ A number of values ​​s included in Ｔ||θ The s corresponding to the value θ that is uniquely determined from the identifier ID of the Ｔ||θ The latest private key csk is obtained by adding a signature to a hash value of information including the identifier ID and the current time T using the Schnorr signature with a signature key being the sum or linear combination of ＩＤ，Ｔ The authenticated key exchange system of claim 1 , configured to output:

3. A device that shares a session key with another device as a communication partner, A static private key ssk corresponding to the master public key MPK and its own identifier ID ＩＤ and the key update information ku at the current time T Ｔ Using the input, the latest secret key csk at the current time T is obtained using Schnorr signature without using pairing calculation. ＩＤ，Ｔ a latest private key generator configured to output a latest private key; The master public key MPK and the latest private key csk corresponding to its own identifier ID at the current time T ＩＤ，Ｔ With input, temporary private key esk ＩＤ and the temporary public key epk ＩＤ a temporary key generator configured to output a temporary key; The master public key MPK, the user's own identifier ID, the communication partner's identifier ID', and the latest secret key csk corresponding to the user's own identifier ID at the current time T ＩＤ，Ｔ and a temporary private key esk corresponding to the identifier ID ＩＤ and a temporary public key epk corresponding to the identifier ID′ of the communication partner ＩＤ' a session key generating unit configured to receive the above-mentioned input and output a session key SK to be shared with the communication partner; Equipment having the above configuration.

4. 1. An authentication key exchange method for use in an authentication key exchange system including a key generation device and a plurality of devices, comprising: The key generating device, Security Parameter 1 λ a parameter generation step for outputting a master private key MSK, a master public key MPK, and an initial revoked party list RL using the total number N of devices and the number of devices as input; The master secret key MSK, the master public key MPK, and the identifier ID of the device are input, and a static secret key ssk corresponding to the identifier ID is ＩＤ a static private key generation step that outputs The master public key MPK and the new revoked list RL are input, the current time T is incremented, and the revoked list RL at the current time T is Ｔ a revocation list update procedure for updating the revocation list RL to the new revocation list RL; The master private key MSK, the master public key MPK, the current time T, and the revoked user list RLT at the current time T are input, and key update information ku at the current time T is generated using the KUNode algorithm. Ｔ and a key update information generation step for outputting the key update information. The device, The master public key MPK and a static private key ssk corresponding to its own identifier ID ＩＤ and the key update information ku at the current time T Ｔ Using the input, the latest secret key csk at the current time T is obtained using Schnorr signature without using pairing calculation. ＩＤ，Ｔ A procedure for generating a new private key, The master public key MPK and the latest private key csk corresponding to its own identifier ID at the current time T ＩＤ，Ｔ With input, temporary private key esk ＩＤ and the temporary public key epk ＩＤ a temporary key generation step for outputting The master public key MPK, the user's own identifier ID, the communication partner's identifier ID', and the latest secret key csk corresponding to the user's own identifier ID at the current time T ＩＤ，Ｔ and a temporary private key esk corresponding to the identifier ID ＩＤ and a temporary public key epk corresponding to the identifier ID′ of the communication partner ＩＤ' a session key generation step of outputting a session key SK to be shared with the communication partner, using the above-mentioned An authenticated key exchange method that performs

5. A program for causing a computer to function as a key generating device included in the authentication key exchange system according to claim 1 or 2.

6. A program for causing a computer to function as a device included in the authentication key exchange system described in claim 1 or 2.

Images