COMMUNICATION SYSTEM AND COMMUNICATION METHOD

Abstract

This invention reduces, as much as possible, the number of communications between communication devices and the number of asymmetric pairing computations, in encrypted communication using ID-based encryption technology.　For that purpose, a first communication device transmits first device identification information for identifying the first communication device to a second communication device, and the second communication device receives the first device identification information and transmits, to the first communication device, a public key certificate which includes second device identification information for identifying the second communication device. Furthermore, the first communication device receives the public key certificate, verifies the public key certificate, and if the public key certificate was determined to be valid, generates a session key for encrypted communication with the second communication device using the first device identification information by one first asymmetric pairing computation. Meanwhile, the second communication device generates a session key for encrypted communication with the first communication device using the first device identification information by one second asymmetric pairing computation.

Description

[Technical Field]

[0001] The present disclosure relates to a communication system and a communication method. [Background technology]

[0002] When communication devices, such as Internet of Things (IoT) devices, communicate with each other, or when communication devices communicate with gateways or cloud servers, it is important to authenticate each other to confirm that the communication devices are genuine. Therefore, the use of authenticated key exchange (AES) is being considered. The ID (Identification)-based authenticated key exchange method uses an ID, an arbitrary string of characters chosen by the user, as the public key. The IoT device's manufacturing code or serial number can be used as the public key. Using this feature, a protocol for ID-based authenticated key exchange allows communication devices to mutually authenticate each other to verify that their IDs are genuine. If authentication is successful, a shared session key can be generated, and the communication devices can then use that session key for encrypted communication.

[0003] Non-Patent Document 1 describes a first conventional method as an ID-based encryption method performed between communication devices. The first conventional method is the method with the least amount of calculation among existing ID-based authenticated key exchanges, and requires only one pairing calculation. Here, the first conventional method will be briefly explained using FIG. 10. FIG. 10 is a sequence diagram showing the processing of the first conventional method.

[0004] As shown in FIG. 10, of the two communication devices (IoT device 105 and tablet terminal 107), first, the tablet terminal 107 sends a second device identifier ID to the IoT device 105 to identify itself (the tablet terminal 107). S (S110). As a result, the IoT device 105 transmits the second device identifier ID S Receive.

[0005] Next, the IoT device 105 receives a second device identifier IDS , and generate the first short-term private key x C and use this first short-term private key x C The first short-term public key X that is paired with C Then, the IoT device 105 generates a first device identifier ID for identifying the device itself (IoT device 105) to the tablet terminal 107 (S111). C , and a first short-term public key X C (S112). As a result, the tablet terminal 107 transmits the first device identifier ID C , and a first short-term public key X C Receive.

[0006] Next, the tablet terminal 107 generates the second short-term private key x C and use this second short-term private key x C A second short-term public key X that is paired with S Then, the tablet terminal 107 generates the second short-term public key X for the IoT device 105 (S113). S (S115). As a result, the IoT device 105 transmits the second short-term public key X S Receive.

[0007] Next, the IoT device 105 generates a first short-term private key X by a single asymmetric pairing operation. C and a second short-term public key X S The session key (shared key) SK for performing encrypted communication using the ID-based encryption method with the tablet terminal 107 is generated using the above (S117).

[0008] On the other hand, the tablet terminal 107 generates the second short-term private key X by one asymmetric pairing operation. S and the first short-term public key X C A session key (shared key) SK for encrypted communication with the IoT device 105 is generated using the above (S118).

[0009] As a result of the above, the IoT device 105 and the tablet terminal 107 perform encrypted communication with each other using the session key SK (S19).

[0010] Patent Document 1 also describes a second conventional method as an ID-based encryption method used between communication devices. The second conventional method requires two communications (one round trip), which is fewer than the first conventional method. The second conventional method will now be briefly described with reference to Fig. 11. Fig. 11 is a sequence diagram showing the processing of the second conventional method.

[0011] As shown in FIG. 11, of the two communication devices (IoT device 205 and tablet terminal 207), first, the IoT device 205 acquires a first short-term private key x C and use this first short-term private key x C The first short-term public key X that is paired with C (S211). Then, the IoT device 205 generates a first device identifier ID for identifying the device itself (IoT device 205) to the tablet terminal 207. C , and a first short-term public key X C (S212). As a result, the tablet terminal 207 transmits the first device identifier ID C , and a first short-term public key X C Receive.

[0012] Next, the tablet terminal 207 generates the second short-term private key x C and use this second short-term private key x C A second short-term public key X that is paired with S Then, the tablet terminal 207 generates the second short-term public key X to the IoT device 205 (S213). S , and a second device identifier ID for identifying the device itself (tablet terminal 207) S (S215). As a result, the IoT device 205 transmits the second short-term public key X S and a second device identifier ID S Receive.

[0013] Next, the IoT device 205 performs two asymmetric pairing operations to generate a first device identifier ID C and a second device identifier ID SIn the second conventional method, the first device identifier ID of the device is used to generate a session key (shared key) SK for performing encrypted communication with the tablet terminal 207 using the first device identifier ID of the device (S217). C and the second device identifier ID of the other device. S Two asymmetric pairing operations are required for

[0014] On the other hand, the tablet terminal 207 performs two second asymmetric pairing calculations to obtain the first device identifier ID C and a second device identifier ID S A session key (shared key) SK for encrypted communication with the IoT device 105 is generated using the above (S218).

[0015] As a result of the above, the IoT device 205 and the tablet terminal 207 perform encrypted communication with each other using the session key SK (S219). [Prior art documents] [Non-patent literature]

[0016] [Non-Patent Document 1] Patent Publication No. 2021-19223 [Patent documents]

[0017] [Patent Document 1] Kai Kinoshita, Akira Nagai, Junichi Tomita, Kotaro Suzuki, Jun Fujioka, ID-based authenticated key exchange method for application to TLS1.3, 2020 Symposium on Cryptography and Information Security Summary of the Invention [Problem to be solved by the invention]

[0018] However, the first conventional method requires three communications (S110, S112, S115), totaling 1.5 round trips. Therefore, when used with IoT devices, communication may occur over a narrowband network, and network delays and other factors may prevent the method from being used within a practical execution time.

[0019] In addition, the second conventional method requires two asymmetric pairing operations when executing the ID-based encryption method (S217, S218), which increases the amount of calculation compared to the first conventional method. This creates the problem that it may not be possible to use it within a practical execution time on devices with low CPU performance, such as IoT devices.

[0020] The present invention has been made in consideration of the above points, and aims to enable encrypted communication using ID-based encryption technology to be used within a practical execution time by minimizing the number of communications between communication devices and the number of asymmetric pairing calculations. [Means for solving the problem]

[0021] In order to achieve the above object, the invention according to claim 1 is a communication system having a first communication device and a second communication device that perform encrypted communication using an ID-based encryption method, wherein the first communication device: A first short-term private key is generated based on the first long-term private key received from the KGC server and a random value, and the first short-term private key is paired with the first short-term private key and the second communication device Used when performing the second asymmetric pairing operation a first short-term public key generation unit that generates a first short-term public key; First device identification information for identifying the first communication device to the second communication device , and the first short-term public key A first transmitting unit that transmits and, and the second communication device has the first device identification information and the first short-term public key a second receiving unit that receives the a second long-term private key generation unit that generates a second long-term private key; a second long-term public key generation unit that generates a second long-term public key that pairs with the second long-term private key; and a second short-term public key generation unit that generates a second short-term private key based on the second long-term private key and a random value, and generates a second short-term public key that pairs with the second short-term private key and is used by the first communication device when performing a first asymmetric pairing operation. to the first communication device, the second short-term public key, the second long-term public key, and Second device identification information for identifying the second communication device for certifying the second long-term public key Public Key Certificate and, and a second transmitting unit that transmits the first communication device. the second short-term public key; anda first receiving unit that receives the public key certificate; a verifying unit that verifies the public key certificate; and a first receiving unit that, when the public key certificate is determined to be valid by the verification by the verifying unit, verifies the public key certificate. The aforementioned a first session key generation unit that generates a session key for the encrypted communication with the second communication device by using the first device identification information through a first asymmetric pairing operation, The aforementioned a second session key generation unit that generates a session key for the encrypted communication with the first communication device by using the first device identification information through a second asymmetric pairing operation; the first long-term private key is generated by the KGC server using parameters for generating a first long-term private key, and the second long-term public key generation unit generates the second long-term public key using parameters for generating a second long-term public key that can be used in the second asymmetric pairing operation together with the parameters for generating the first long-term private key and that have been received from the KGC server by the second receiving unit. It is a communication system. [Effects of the Invention]

[0022] As described above, according to the present invention, when performing encrypted communication using ID-based encryption technology, the number of communications between communication devices and the number of asymmetric pairing calculations can be minimized, thereby achieving the effect of enabling use within a practical execution time. [Brief explanation of the drawings]

[0023] [Figure 1] 1 is a schematic diagram of a communication system according to an embodiment. [Figure 2] FIG. 2 is a hardware configuration diagram of a KGC server and a certificate authority server according to an embodiment. [Figure 3] FIG. 1 is a hardware configuration diagram of a communication device (IoT device, tablet terminal) according to an embodiment. [Figure 4] FIG. 2 is a functional configuration diagram of each server and each device in the communication system according to the embodiment. [Figure 5] FIG. 10 is a sequence diagram showing pre-processing before executing the ID-based encryption method. [Figure 6] FIG. 10 is a sequence diagram illustrating a process of the ID-based authentication method according to the embodiment. [Figure 7] FIG. 2 is a diagram illustrating a protocol of an ID-based authentication method according to an embodiment. [Figure 8]FIG. 1 is a diagram defining notation in asymmetric pairing operations. [Figure 9] FIG. 1 is a diagram defining the notation of a hash function. [Figure 10] FIG. 10 is a sequence diagram showing the processing of a first conventional method. [Figure 11] FIG. 10 is a sequence diagram showing the processing of a second conventional method. DETAILED DESCRIPTION OF THE INVENTION

[0024] [Overall structure] Fig. 1 is a schematic diagram of a communication system according to an embodiment of the present invention. As shown in Fig. 1, the communication system 1 of this embodiment is constructed by a KGC server 3, a certificate authority server 4, an IoT device 5, and a tablet terminal 7. Note that while Fig. 1 shows two devices, the IoT device 5 and the tablet terminal 7, there may be three or more devices, and the IoT device 5 is an example of a first communication device, and the tablet terminal 7 is an example of a second communication device. In addition to IoT devices and tablet terminals, the communication devices also include notebook PCs, servers, etc.

[0025] Furthermore, the KGC server 3, the certification authority server 4, the IoT device 5, and the tablet terminal 7 can communicate via a communication network 100 such as the Internet. The connection form of the communication network 100 may be either wireless or wired. The KGC server 3 and the certification authority server 4 are configured by one or more computers. The KGC server may be referred to as a "KGC system." The certification authority server may be referred to as a "certification authority system."

[0026] The KGC server 3 is a server of the KGC (Key Generation Center: ID-based key generation station) and issues (long-term) private keys, etc. Note that the "KGC server" may also be referred to as the "KGC system."

[0027] The certification authority server 4 is a server of a certification authority (CA) and issues public key certificates and the like.

[0028] The IoT device 5 and the tablet terminal 7 are communication devices that perform mutual authentication using ID-based encryption, and an example of an IoT device is a web camera. The IoT device 5 and the tablet terminal 7 perform encrypted communication with each other by executing the ID-based encryption method.

[0029] [Hardware configuration] <Hardware configuration of each server> First, the hardware configuration of the KGC server 3 and the certification authority server 4 will be described with reference to Fig. 2. Fig. 2 is a diagram showing the hardware configuration of the KGC server 3 and the certification authority server 4.

[0030] 2, the KGC server 3 includes a processor 301, a memory 302, an auxiliary storage device 303, a connection device 304, a communication device 305, and a drive device 306. The hardware components constituting the KGC server 3 are connected to each other via a bus 307.

[0031] The processor 301 serves as a control unit that controls the entire KGC server 3, and includes various computing devices such as a CPU (Central Processing Unit). The processor 301 reads and executes various programs on the memory 302. The processor 301 may also include a GPGPU (General-purpose computing on graphics processing units).

[0032] The memory 302 has a main storage device such as a ROM (Read Only Memory), a RAM (Random Access Memory), etc. The processor 301 and the memory 302 form a so-called computer, and the processor 301 executes various programs read onto the memory 302, thereby enabling the computer to realize various functions.

[0033] The auxiliary storage device 303 stores various programs and various information used when the various programs are executed by the processor 301.

[0034] The connection device 304 is a connection device that connects an external device (for example, a display device 310, an operation device 311) and the KGC server 3.

[0035] The communication device 305 is a communication device for transmitting and receiving various information between other devices (including devices, servers, and systems).

[0036] The drive device 306 is a device for setting the recording medium 330. The recording medium 330 here includes media that record information optically, electrically, or magnetically, such as a CD-ROM (Compact Disc Read-Only Memory), a flexible disk, and a magneto-optical disk. Further, the recording medium 330 may include semiconductor memories that record information electrically, such as a ROM (Read Only Memory) and a flash memory.

[0037] Note that the various programs installed in the auxiliary storage device 303 are installed, for example, when the distributed recording medium 330 is set in the drive device 306 and the various programs recorded on the recording medium 330 are read by the drive device 306. Alternatively, the various programs installed in the auxiliary storage device 303 may be installed by being downloaded from a network via the communication device 305.

[0038] Also, FIG. 2 shows the hardware configuration of the certification authority server 4, but since each configuration is the same except that the reference numerals change from the 300s to the 400s, these descriptions are omitted.

[0039] <Hardware Configuration of IoT Devices and Tablet Terminals> Next, the hardware configuration of the IoT device 5 will be described with reference to Fig. 3. Fig. 3 is a hardware configuration diagram of each communication device (IoT device, tablet terminal) according to the embodiment. Note that the IoT device 5 and tablet terminal 7 do not necessarily have to have the configuration as shown in Fig. 3.

[0040] 3, the IoT device 5 includes a processor 501, a memory 502, an auxiliary storage device 503, a communication device 504, and a GPS (Global Positioning System) device 505. The IoT device 5 also includes an audio input device 506, an audio output device 507, a display device 508, an imaging device 509, a connection device 510, and a short-range wireless communication device 511. The hardware components constituting the IoT device 5 are connected to each other via a bus 520.

[0041] The processor 501 serves as a control unit that controls the entire IoT device 5, and includes various arithmetic devices such as a CPU (Central Processing Unit). The processor 501 reads various programs into the memory 502 and executes them. The processor 501 may include a GPGPU (General-purpose computing on graphics processing units).

[0042] The memory 502 has a main storage device such as a ROM (Read Only Memory), a RAM (Random Access Memory), etc. The processor 501 and the memory 502 form a so-called computer, and the processor 501 executes various programs read onto the memory 502, causing the computer to realize various functions.

[0043] The auxiliary storage device 503 stores various programs and various information used when the processor 501 executes the various programs.

[0044] The communication device 504 is a communication device for transmitting and receiving various information with other devices (including devices, servers, and systems). The GPS device 505 detects the location information of the IoT device 5.

[0045] The voice input device 506 detects voice information such as the user's voice and ambient sounds. The voice output device 507 is a device that outputs various information received from other devices as voice, for example.

[0046] The display device 508 is a device that displays images of various information received from other devices, for example.

[0047] The imaging device 509 captures images of the user and the surroundings and generates image information.

[0048] The connection device 510 is a connection device used to connect various sensors, external memories, etc. to the IoT device 5.

[0049] The short-range wireless communication device 511 is a wireless device for performing short-range wireless communication with other devices near the IoT device 5.

[0050] Also, in FIG. 3, the hardware configuration of the tablet terminal 7 is shown, but since only the reference numerals change from the 500 series to the 700 series and each configuration is the same, these explanations are omitted.

[0051] 〔Functional Configuration of the Communication System〕 Subsequently, the functional configuration of the communication system will be described using FIG. 4. FIG. 4 is a functional configuration diagram of each system and each communication device of the communication system according to the embodiment.

[0052] <Functional Configuration of the KGC Server 3> The KGC server 3 has a transmission / reception unit 31 and a long-term secret key generation unit 33. Each of these units is a function that the processor 301 realizes in the KGC server 3 using one or more programs installed in the KGC server 3.

[0053] The transmission / reception unit 31 transmits and receives data to / from other servers and communication devices via the communication network 100.

[0054] The long-term secret key generation unit 33 generates a first long-term secret key ssk for providing to the IoT device 5. C to generate.

[0055] <Functional configuration of the certification authority server 4> The certification authority server 4 has a transmission / reception unit 41 and a public key certificate generation unit 43. Each of these units is a function that the processor 401 causes the certification authority server 4 to implement using one or more programs installed in the certification authority server 4.

[0056] Transmission / reception unit 4 1 transmits and receives data to / from other servers and communication devices via the communication network 100.

[0057] Public key certificate generation unit 4 3 generates a public key certificate Cert for the long-term public key spk S obtained from the tablet terminal 7 and the second device identifier ID S and generates a public key certificate Cert S for. The public key certificate Cert S is an electronic certificate that certifies the second long-term public key spk S and the second device identifier ID S . Note that the device identifier is an example of device identification information (the same applies hereinafter).

[0058] <Functional configuration of the IoT device> The IoT device 5 has a transmission / reception unit 51, a short-term public key generation unit 54, a verification unit 56, and a session key generation unit 57. Each of these units is a function that the processor 501 causes the IoT device 5 to implement using one or more programs installed in the IoT device 5. Furthermore, the IoT device 5 has a storage unit 50. The storage unit 50 is realized by a memory 502 or an auxiliary storage device 503. In the storage unit 50, a first device identifier ID, which is an example of first device identification information for identifying the device itself (IoT device 5), C etc. are stored.

[0059] The transmitting / receiving unit 51 transmits and receives data to and from other servers and communication devices via the communication network 100.

[0060] The short-term public key generation unit 54 receives the first long-term secret key ssk from the KGC server 3. C , and a random value esk C First short-term private key x based on C and use this first short-term private key x C The first short-term public key X that is paired with C Generate.

[0061] The verification unit 56 verifies the public key certificate Cert S Verification will be carried out.

[0062] The session key generation unit 57 generates the public key certificate Cert S is determined to be valid, a first device identifier ID is obtained by one asymmetric pairing operation. C The IoT device 5 generates a session key (shared key) SK for performing encrypted communication using the ID-based encryption method with the tablet terminal 7 using the device identifier ID S Therefore, it is not possible to authenticate the tablet device 7, which is the other party of the encrypted communication, in this state. S It can be authenticated by:

[0063] <Tablet device functional configuration> The tablet terminal 7 has a transmission / reception unit 71, a long-term private key generation unit 72, a long-term public key generation unit 73, a short-term public key generation unit 74, and a session key generation unit 77. Each of these units is a function that the processor 701 causes the tablet terminal 7 to realize using one or more programs installed in the tablet terminal 7. The tablet terminal 7 also has a storage unit 70. The storage unit 70 is realized by a memory 702 or an auxiliary storage device 703. The storage unit 70 stores a public key certificate Cert obtained from a certification authority.S etc. are stored.

[0064] The transmitting / receiving unit 71b transmits and receives data to and from other devices via the communication network 100.

[0065] The long-term private key generation unit 72 generates a predetermined value between 1 and P.

[0066]

number

[0067] The long-term public key generation unit 73 generates a second long-term private key ssk S The second long-term public key spk that is paired with S Generate.

[0068]

number

[0069] The session key generator 77 generates the first device identifier ID by one second asymmetric pairing operation. C The tablet terminal 7 generates a session key (shared key) for encrypted communication with the IoT device 5 using the first device identifier ID of the IoT device. C This makes it possible to authenticate the IoT device 5 that is the other party in the encrypted communication.

[0070] [Processing or Operation of the Embodiment] Next, the processing or operation of the communication system 1 will be described with reference to Figs. 5 to 9. Note that in this embodiment, a system is adopted in which there are restrictions on the second long-term public key and second long-term private key held by the tablet terminal 7. The second long-term private key depends on the elliptic curve parameters used in ID-based authentication. Also, different device identifiers ID are assigned to the IoT device 5 and the tablet terminal 7. The master private key used in the KGC server 3 is w, and the master public key is generated using a parameter g1 for generating the long-term public key.

[0071]

number

[0072] <Pre-processing> First, the pre-processing before executing the ID-based encryption method will be described with reference to Fig. 5. Fig. 5 is a sequence diagram showing the pre-processing before executing the ID-based encryption method.

[0073] As shown in FIG. 5, in the KGC server 3, the long-term secret key generation unit 33 generates a first long-term secret key ssk C Generate a long-term private key (ssk) (S1). C is expressed as follows using the parameter g2 for generating the long-term private key:

[0074]

number

[0075] Then, the transmitter / receiver 31 transmits the master public key W and the first long-term secret key ssk to the IoT device 5. CAs a result, the transmitter / receiver 51 of the IoT device 5 transmits the master public key W and the first long-term secret key ssk C is received and stored in the storage unit 50.

[0076] Furthermore, the transmitting / receiving unit 31 of the KGC server 3 transmits the master public key W and the long-term public key generation parameters g1 to the tablet terminal 7 (S5). As a result, the transmitting / receiving unit 71 of the tablet terminal 7 receives the master public key W and the long-term public key generation parameters g1. Then, in the tablet terminal 7, the long-term private key generation unit 72 obtains a random value to generate the second long-term private key ssk S Furthermore, the long-term public key generation unit 73 generates a second long-term private key ssk S The second pair long term public key spk S is generated (S6).

[0077] Next, the transmitting / receiving unit 71 transmits the second long-term public key spk to the certification authority server 4. S , and a second device identifier ID for identifying the tablet terminal 7 S In response to this, the transmitting / receiving unit 41 of the certificate authority server 4 requests a public key certificate by transmitting the second long-term public key spk S , and a second device identifier ID S Receive.

[0078] Next, in the certificate authority server 4, the public key certificate generation unit 43 generates the second long-term public key spk S , and a second device identifier ID S and a second long-term public key spk S Public key certificate Cert to prove S Then, the transmitting / receiving unit 41 generates the public key certificate Cert S As a result, the transmitter / receiver 71 of the tablet terminal 7 transmits the public key certificate Cert S Receive.

[0079] Thus, the preprocessing before executing the ID-based encryption method is completed.

[0080] <ID-based authentication method process> Subsequently, with reference to FIGS. 6 to 9, the process of the ID-based authentication method of this embodiment will be described. FIG. 6 is a sequence diagram showing the process of the ID-based authentication method of the embodiment.

[0081] First, the short-term public key generation unit 54 of the IoT device 5 generates a first short-term secret key x C based on the first long-term secret key ssk C received from the KGC server 3 and a random value esk C , and generates a first short-term public key X C paired with this first short-term secret key x C (S11). Then, the transceiver unit 51 transmits a first device identifier ID C for identifying its own device (IoT device 5) and the first short-term public key X C generated by the short-term public key generation unit 54 to the tablet terminal 7 (S12). As a result, the transceiver unit 71 of the tablet terminal 7 receives the first device identifier ID C and the first short-term public key X C .

[0082] Next, in the tablet terminal 7, the short-term public key generation unit 74 generates a second short-term secret key x S based on the second long-term secret key ssk S and a random value esk C , and generates a second short-term public key X C paired with this second short-term secret key x S (S13). ​​​​​​​​, and the public key certificate Cert S Receive.

[0084] Next, in the IoT device 5, the verification unit 56 verifies the public key certificate Cert received from the tablet terminal 7. S Then, the public key certificate Cert is verified by the verification unit 56 (S16). S is valid, the session key generation unit 57 generates the first device identifier ID C The session key (shared key) SK for performing encrypted communication using the ID-based encryption method with the tablet terminal 7 is generated using the above (S17).

[0085] On the other hand, in the tablet terminal 7, the session key generation unit 77 also performs a single second asymmetric pairing operation (σ1) to generate the first device identifier ID C A session key (shared key) for encrypted communication with the IoT device 5 is generated using the above (S18).

[0086] As a result, the IoT device 5 and the tablet terminal 7 perform encrypted communication with each other (S19).

[0087] <Protocol> Next, a protocol of the ID-based authentication method will be described with reference to Figs. 7 to 9, showing the process of Fig. 6 in detail. Fig. 7 is a diagram showing the protocol of the ID-based authentication method according to an embodiment. Fig. 8 is a diagram defining notation in asymmetric pairing calculations. Fig. 9 is a diagram defining notation for hash functions. An example of asymmetric pairing is optimal ate pairing on a BN curve, as shown in Reference 1.

[0088] <Reference 1> K. Kasamatsu, S. Kanno, T. Kobayashi and Y. Kawahara: Optimal Ate Pairing draftkasamatsu-optimal-ate-pairings-00. Network Working Group Internet-Draft: to apper. Here, the esk in Figure 7 C and esk S The "←" in the above means selection (acquisition). C ,esk C ) etc., "," is simply, ssk C Value and esk C Indicates that the values ​​of are listed.

[0089] 8 and 9, ":" is used when the value on the right side indicates the meaning of the value on the left side. However, "e:G1×G2→G T : Asymmetric pairing" is the process of asymmetric pairing, where two inputs G1 and G2 are used to generate an output G. T This means using the function e such that

[0090] As described above, the IoT device 5 uses a device identifier ID to identify the tablet terminal 7. S Therefore, it is not possible to authenticate the tablet device 7, which is the other party of the encrypted communication, in this state. S It can be authenticated by:

[0091] <Other processing> Next, a process for confirming whether the same session key (shared key) has been generated between the IoT device 5 and the tablet terminal 7 after the processes (S17, S19) and before the process (S19) will be described.

[0092] First, tablet device 7 generates three keys (keys, keyc, K) from the generated session key as follows: (keys, keyc, K) = MGF1(SK, n). Here, MGF1 is a mask function that takes a seed and a mask length n as input and outputs a mask value with n as the bit length. The generated mask value is divided into thirds to generate three keys (keys, keyc, SK).

[0093] Next, the tablet device 7 uses the key keys to calculate the MAC value macs = MAC(keys, sid) of sid generated in the above embodiment, where MAC is a MAC function. The tablet device 7 transmits macs to the IoT device 5.

[0094] Using a similar procedure, the IoT device 5 generates three keys (keys, keyc, SK) = MGF1(K, n). The IoT device 5 pre-calculates the MAC value macc = MAC(keyc, sid) of sid using a key keyc that is different from the key used by the tablet device 7. When the IoT device 5 receives macs from the tablet device 7, it verifies the MAC of the received macs using the key keyc that it generated itself (the IoT device 5). If the verification is successful, the IoT device 5 sends macc to the tablet device 7. When the tablet terminal 7 receives the macc from the IoT device 5, it verifies the macc using the key keyc generated by its own device (tablet terminal 7).

[0095] If MAC verification is successful in both the IoT device 5 and the tablet terminal 7, it is guaranteed that the same key SK and the same key K have been generated in the IoT device 5 and the tablet terminal 7.

[0096] [Major Effects of the Embodiments] As described above, according to this embodiment, based on the first conventional method, ID-based authentication is used on the tablet terminal 7 side, while certificate authentication is used on the IoT device 5 side. By taking advantage of this, a design is adopted in which the device identifier ID is not required to generate some short-term public keys, thereby reducing the number of communications to two (one round trip) while keeping the number of asymmetric pairings at one.

[0097] That is, the IoT device 5 uses a device identifier ID to identify the tablet terminal 7. S Therefore, it is not possible to authenticate the tablet device 7, which is the other party of the encrypted communication, in this state. S Furthermore, the tablet terminal 7 can authenticate the first device identifier ID of the IoT device. C This makes it possible to authenticate the IoT device 5, which is the other party in the encrypted communication. As a result, when performing encrypted communication using ID-based encryption technology, the number of communications and asymmetric pairing calculations performed between the communication devices (the IoT device 5 and the tablet terminal 7) can be minimized, thereby achieving the effect of enabling use within a practical execution time.

[0098] Furthermore, the method of this embodiment is a safety model, as shown in Reference 2, and is therefore secure in terms of security. Furthermore, the method of this embodiment is applicable to TLS1.3 because communication is performed twice. Therefore, this method can be used even when you want to use the TLS1.3 protocol as is, such as HTTPS or MQTTS.

[0099] <Reference 2> Ustaoglu, B. Integrating identity-based and certificate-based authenticated key exchange protocols. Int. J. Inf. Secur. 10, 201-212 (2011). 〔supplement〕 The present invention is not limited to the above-described embodiment, and may have the following configurations or processes (operations).

[0100] The KGC server 3, the certification authority server 4, and the communication device 7 can also be realized by a computer and a program, but this program can also be recorded on a (non-transitory) recording medium or provided via a network such as the Internet. [Explanation of symbols]

[0101] 1. Communication Systems 3 KGC Server 4 Certificate Authority Server 5 IoT devices (examples of first communication devices) 7. Tablet device (an example of a second communication device) 50 Storage section 51 Transmitting / receiving unit (an example of a first transmitting unit, an example of a first receiving unit) 54 Short-term public key generation unit 56 Verification Department 57 Session key generation unit (an example of a first session key generation unit) 70 Storage section 71 Transmitting / receiving unit (an example of a second transmitting unit, an example of a second receiving unit) 72 Long-term secret key generation unit 73 Long-term public key generator 74 Short-term public key generation unit 77 Session key generation unit (an example of a second session key generation unit) 100 Communication Network

Claims

1. A communication system having a first communication device and a second communication device that perform encrypted communication using an ID-based encryption method, The first communication device includes: a first short-term public key generation unit that generates a first short-term private key based on the first long-term private key received from the KGC server and a random value, and generates a first short-term public key that is paired with the first short-term private key and is used when the second communication device performs a second asymmetric pairing operation; a first transmission unit that transmits, to the second communication device, first device identification information for identifying the first communication device and the first short-term public key; having The second communication device includes: a second receiving unit for receiving the first device identification information and the first short-term public key; a second long-term private key generation unit that generates a second long-term private key; a second long-term public key generation unit that generates a second long-term public key paired with the second long-term private key; a second short-term public key generation unit that generates a second short-term private key based on the second long-term private key and a random value, and generates a second short-term public key that is paired with the second short-term private key and is used by the first communication device when performing a first asymmetric pairing operation; a second transmission unit that transmits to the first communication device the second short-term public key, the second long-term public key, and a public key certificate that includes second device identification information for identifying the second communication device and certifies the second long-term public key; having The first communication device includes: a first receiving unit for receiving the second short-term public key and the public key certificate; A verification unit that verifies the public key certificate; a first session key generation unit that generates a session key for the encrypted communication with the second communication device by performing the first asymmetric pairing operation once using the first device identification information when the public key certificate is determined to be valid by the verification by the verification unit; having The second communication device includes: a second session key generation unit that generates a session key for the encrypted communication with the first communication device by performing the second asymmetric pairing operation once, using the first device identification information; The first long-term private key is generated by the KGC server using a parameter for generating the first long-term private key; the second long-term public key generation unit generates the second long-term public key using a second long-term public key generation parameter that can be used in the second asymmetric pairing operation together with the first long-term private key generation parameter and that has been received from the KGC server by the second receiving unit; Communication systems.

2. The communication system according to claim 1 , wherein the first communication device is an IoT device, and the second communication device is a terminal that remotely controls the IoT device.

3. A communication method executed by a communication system having a first communication device and a second communication device that perform encrypted communication using an ID-based encryption method, comprising: The first communication device includes: a first short-term public key generation process for generating a first short-term private key based on a first long-term private key received from a KGC server and a random value, and generating a first short-term public key that is paired with the first short-term private key and is used when the second communication device performs a second asymmetric pairing operation; a first transmission process for transmitting first device identification information for identifying the first communication device and the first short-term public key to the second communication device; Run The second communication device includes: a second receiving process for receiving the first device identification information and the first short-term public key; a second long-term private key generation process for generating a second long-term private key; a second long-term public key generation process for generating a second long-term public key paired with the second long-term private key; a second short-term public key generation process for generating a second short-term private key based on the second long-term private key and a random value, and generating a second short-term public key that is paired with the second short-term private key and is used by the first communication device when performing a first asymmetric pairing operation; a second transmission process for transmitting to the first communication device the second short-term public key, the second long-term public key, and a public key certificate for certifying the second long-term public key, the public key certificate including second device identification information for identifying the second communication device; Run The first communication device includes: a first receiving process for receiving the second short-term public key and the public key certificate; a verification process for verifying the public key certificate; a first session key generation process for generating a session key for the encrypted communication with the second communication device by performing the first asymmetric pairing operation once using the first device identification information when it is determined that the public key certificate is valid by the verification process; Run The second communication device includes: executing a second session key generation process for generating a session key for the encrypted communication with the first communication device by using the first device identification information through one second asymmetric pairing operation; The first long-term private key is generated by the KGC server using a parameter for generating the first long-term private key; the second long-term public key generation process includes a process of generating the second long-term public key by using a second long-term public key generation parameter that can be used for the second asymmetric pairing operation together with the first long-term private key generation parameter and that has been received from the KGC server by the second receiving process; Communication methods.

Images