Cryptographic communication system, cryptographic communication device, cryptographic communication method, and cryptographic communication program

Abstract

To provide an encryption communication system capable of realizing high-speed communication by pre-reading a key without requiring a communication protocol for key ID notification.SOLUTION: A transmission device according to the embodiment includes an encryption key prefetch unit and an encryption chunk generation unit. The encryption key prefetch unit obtains an encryption key for encrypting plaintext data from a key management system before inputting the plaintext data. The encryption chunk generation unit generates a packet in which first encryption data obtained by encrypting first plaintext data using a first encryption key and a first key ID of the first encryption key are stored, and a second key ID of a second encryption key used for encrypting second plaintext data transmitted after the first plaintext data is embedded. A receiving device includes an encryption chunk analysis unit and a decryption key prefetch unit. The encryption chunk analysis unit analyzes the packet and reads the second key ID. The decryption key prefetch unit acquires the second encryption key corresponding to the second key ID read by the encryption chunk analysis unit from the key management system.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] Embodiments of the present invention relate to a cryptographic communication system, a cryptographic communication device, a cryptographic communication method, and a cryptographic communication program.

Background Art

[0002] A method is known in which a random number shared between two locations using quantum key distribution technology (QKD: Quantum Key Distribution) is used as a common key (encryption key, decryption key), and secure cryptographic communication such as a one-time pad (OTP) is performed.

[0003] As a method for accelerating the communication of a cryptographic communication application (cryptographic communication device) using this QKD, a method of prefetching an encryption key before receiving a plaintext and prefetching a decryption key before receiving a ciphertext has been proposed.

[0004] Also, as a method for providing a key shared using QKD to a cryptographic communication application, a method of installing a key management system is known. As a typical interface specification defining the key exchange between this key management system and the cryptographic communication application, there is "ETSI GS QKD014".

[0005] In this interface, first, a key ID is issued together with an encryption key, and when obtaining a decryption key, the corresponding decryption key can be obtained by specifying the same key ID. Therefore, after obtaining a key from the key management system, the device performing encryption needs to notify the decryption device of the key ID by some method.

Prior Art Documents

Patent Documents

[0006]

Patent Document 1

Non-Patent Documents

[0007] [Non-Patent Document 1] European Telecommunications Standards Institute: ETSI GS QKD 014 V1.1.1, 2022-02, p.10 [Summary of the Invention] [Problems to be Solved by the Invention]

[0008] The key acquisition interface compliant with "ETSI GS QKD014" has the feature that a key ID is required to obtain a decryption key. Therefore, when attempting to implement key pre-reading in combination with a key management system that employs the same interface (or a key acquisition interface with similar features), it is necessary to notify the key ID in advance from the communication application on the encryption side to the communication application on the decryption side.

[0009] Therefore, in the method of pre-reading keys in combination with a key management system that employs the key acquisition interface compliant with "ETSI GS QKD014", there are demerits such as the need for a communication protocol for notifying the key ID and the emergence of additional network requirements (such as permitting communication ports through a firewall), making it difficult to utilize this method in communication applications.

[0010] One embodiment of the present invention provides an encrypted communication system, an encrypted communication device, an encrypted communication method, and an encrypted communication program that can achieve high-speed communication by pre-reading keys without requiring a communication protocol for notifying the key ID or the like. [Means for Solving the Problems]

[0011] According to the embodiment, the encrypted communication system Using a cryptographic key managed by a key management system, a transmission device and a reception device perform cryptographic communication. The key management system has an interface that notifies a key ID when providing an encryption key and returns the encryption key corresponding to the key ID in response to a request for the encryption key specified by the key ID, and shares the encryption key between the first site and the second site by quantum key distribution technology . The transmission device acquires the encryption key managed by the key management system from the first site. The reception device Obtain the encryption key managed by the key management system from the second site . The transmitting device includes an encryption logic unit, a key prefetching unit, a key storage unit, and an encrypted chunk generation unit. The encryption logic unit encrypts the plaintext data using the encryption key obtained from the key management system. The key prefetching unit obtains the encryption key for encrypting the plaintext data from the key management system before the input of the plaintext data. The key storage unit stores the encryption key obtained by the key prefetching unit together with the key ID. The encrypted chunk generation unit generates a packet in which the first encrypted data obtained by encrypting the first plaintext data using the first encryption key and the first key ID of the first encryption key are stored, and embeds the second key ID of the second encryption key stored in the key storage unit, which is used for encrypting the second plaintext data transmitted after the first plaintext data. The receiving device includes a decryption logic unit, an encrypted chunk analysis unit, a decryption key prefetching unit, and a decryption key storage unit. The decryption logic unit decrypts the encrypted data using the encryption key obtained from the key management system. The encrypted chunk analysis unit analyzes the packet and reads the second key ID. The decryption key prefetching unit obtains the second encryption key corresponding to the second key ID read by the encrypted chunk analysis unit from the key management system. The decryption key storage unit stores the encryption key obtained by the decryption key prefetching unit together with the key ID.

Brief Description of the Drawings

[0012]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Best Mode for Carrying Out the Invention

[0013] Hereinafter, embodiments will be described with reference to the drawings.

[0014] FIG. 1 is a diagram showing a configuration example of the encrypted communication system 100 according to the embodiment.

[0015] The encrypted communication application [1] 1 and the encrypted communication application [2] 1 are programs executed on different computers, and are programs that encrypt the input data and send it to each other. Here, a remote meeting connecting site [1] and site [2] is being held. The encrypted communication application [1] 1 operating on the computer at site [1] encrypts the input voice (voice uttered at site [1]) and video (captured image at site [1] or display image on the computer) and sends it as encrypted data to the encrypted communication application [2] 1 operating on the computer at site [2]. On the other hand, the encrypted communication application [1] 1 that has received this encrypted data decrypts the encrypted data and outputs the original voice and video. In parallel with this, the encrypted communication application [2] 1 encrypts the input voice and video and sends it as encrypted data to the encrypted communication application [1] 1. On the other hand, it is assumed that the encrypted communication application [1] 1 that has received this encrypted data decrypts the encrypted data and outputs the original voice and video. Note that although voice and video are assumed to be the targets of encrypted communication, the encrypted communication system 100 of the embodiment is not limited to these, and can target various types of data such as data in document files and CSV files.

[0016] Also, here, as the encrypted communication device that is the entity that executes encrypted communication, the encrypted communication application 1, which is a program executed on a computer, is exemplified. However, the encrypted communication device may be realized as dedicated hardware equipment.

[0017] The encryption communication application 1 obtains an encryption key for encrypting audio and video and a decryption key for decrypting encrypted data from the key management system 2. More specifically, the encryption communication application [1]1 obtains the encryption key and the decryption key from the key management system [1]2, and the encryption communication application [2]1 obtains the encryption key and the decryption key from the key management system [2]2. Here, for example, the encryption key used by the encryption communication application [1]1 for encrypting audio and video and the decryption key used by the encryption communication application [2]1 for decrypting the encrypted data encrypted using this encryption key are the same key. That is, the encryption communication application [1]1 and the encryption communication application [2]1 perform encryption and decryption using the symmetric key encryption method. Hereinafter, the key (decryption key) used by the encryption communication application 1 for decrypting encrypted data may sometimes be referred to as a common key, or may sometimes be referred to as an encryption key (used for encrypting audio and video).

[0018] The key management system 2 shares a common key with another key management system 2 via the QKD device 3 that executes quantum key distribution, and distributes this common key as an encryption key and a decryption key to provide to the encryption communication application 1. Quantum key distribution is a technology that utilizes the behavior of photons. The QKD device 3 transmits and receives information such as random numbers for generating a common key by photons using an optical fiber (or vacuum) as a medium with another QKD device 3. When eavesdropping occurs on the propagation path (medium) of photons, the behavior of photons changes, so the QKD device 3 can detect eavesdropping.

[0019] The key management system 2 has a key acquisition interface that requires the specification of a key ID when acquiring a decryption key, for example, in accordance with "ETSI GS QKD014". For example, when transmitting encrypted data (encrypting voice and video) from the encryption communication application [1]1 to the encryption communication application [2]1, the encryption communication application [1]1 requests an encryption key from the key management system [1]2. The key management system [1]2 that has received this request provides the encryption key to the encryption communication application [1]1 together with the key ID of the encryption key. The encryption communication application [1]1 encrypts voice and video using the provided encryption key and transmits the obtained encrypted data to the encryption communication application [2]1.

[0020] On the other hand, the encryption communication application [2]1 acquires a decryption key for decrypting the encrypted data received from the encryption communication application [1]1 from the key management system [2]2. When acquiring this decryption key, the encryption communication application [2]1 specifies a key ID and requests the key management system [2]2 to provide a decryption key corresponding to the key ID. Therefore, the encryption communication application [1]1 needs to notify the encryption communication application [2]1 of the key ID of the encryption key used for encrypting voice and video by some method. This is the same when transmitting encrypted data (encrypting voice and video) from the encryption communication application [2]1 to the encryption communication application [1]1 in the reverse direction.

[0021] Therefore, the encryption communication system 100 of the embodiment is provided with a mechanism that does not require a communication protocol or the like for notifying the key ID while using a key management system having an interface that requires a key ID for acquiring a decryption key, and this point will be described in detail below.

[0022] First, the configuration of the encryption communication application 1 will be described. As shown in FIG. 1, the encryption communication application 1 has an input unit 11, an encryption processing unit 12, a transmission unit 13, an output unit 14, a decryption processing unit 15, and a reception unit 16.

[0023] The input unit 11 encodes the voice and video input from the computer's microphone and camera. As described above, since the encryption communication system 100 of the embodiment can target various types of data for encrypted communication, not limited to voice and video, various types of data such as document files and CSV file data can be input to the input unit 11.

[0024] The encryption processing unit 12 encrypts the video and audio signals (plaintext data) encoded by the input unit 11.

[0025] The transmission unit 13 transmits the video and audio signals encrypted by the encryption processing unit 12 to another encryption communication application 1.

[0026] The output unit 14 outputs the video and audio signals decoded by the decryption processing unit 15 from the computer's speaker and display.

[0027] The decryption processing unit 15 decrypts the video and audio signals received by the reception unit 16.

[0028] The reception unit 16 receives the encrypted video and audio signals from another encryption communication application 1.

[0029] Figure 2 is a functional block diagram of the encryption processing unit 12.

[0030] As shown in Figure 2, the encryption processing unit 12 includes an encryption logic 121, an encryption chunk generation unit 122, an encryption key storage unit 123, and an encryption key pre-reading unit 124. Also, the encryption processing unit 12 is connected to the input unit 11, the transmission unit 13, and the key management system 2.

[0031] The encryption logic 121 encrypts the voice and video input by the input unit 11 using the encryption key stored in the encryption key storage unit 123.

[0032] The encryption chunk generation unit 122 formats the encrypted data output from the encryption logic 121 as an encryption chunk (packet). Details of the encryption chunk generation unit 122 will be described later. The encryption chunk generation unit 122 inputs the encryption chunk to the transmission unit 13.

[0033] The encryption key storage unit 123 is an area such as a main memory that can be accessed quickly from the encryption logic 121. The encryption key storage unit 123 stores a data table 1231 as shown in FIG. 3.

[0034] As shown in FIG. 3, the data table 1231 has a key ID field, a key data field, and an offset information field.

[0035] The key ID is an identifier for uniquely identifying the encryption key managed by the key management system 2.

[0036] The key data is the encryption key acquired from the key management system 2 together with the key ID (by the encryption key prefetching unit 124 described later), and is, for example, a random number sequence.

[0037] The offset information is information indicating the used byte position when taking out only the necessary number of bytes from the key data for encryption processing and using the remaining byte sequence for the next encryption processing.

[0038] The encryption key prefetching unit 124 acquires, together with the key ID, an encryption key for encrypting the voice or video before the voice or video is input from the input unit 11 from the key management system 2. Details of the encryption key prefetching unit 124 will be described later. The encryption key and the key ID acquired by the encryption key prefetching unit 124 are stored in the data table 1231 of the encryption key storage unit 123.

[0039] FIG. 4 is a functional block diagram of the decoding processing unit 15.

[0040] As shown in FIG. 4, the decoding processing unit 15 includes a cipher chunk analysis unit 151, a decoding logic 152, a decoding key prefetching unit 153, and a decoding key storage unit 154. The decoding processing unit 15 is also connected to the receiving unit 16, the output unit 14, and the key management system 2.

[0041] The cipher chunk analysis unit 151 analyzes the cipher chunk received by the receiving unit 16, and obtains the key ID of the decoding key for decoding the cipher data sent in the cipher chunk, and the key ID of the decoding key to be prefetched for decoding the cipher data scheduled to be sent after the said cipher data. Details of the cipher chunk analysis unit 151 will be described later. The cipher chunk analysis unit 151 transfers the cipher data sent in the cipher chunk to be analyzed and the key ID of the decoding key for decoding the cipher data to the decoding logic 152, and transfers the key ID of the decoding key to be prefetched for decoding the cipher data scheduled to be sent after the said cipher data to the decoding key prefetching unit 153.

[0042] The decoding logic 152 obtains the decoding key corresponding to the key ID received from the cipher chunk analysis unit 151 from the decoding key storage unit 154, and uses the decoding key to decode the cipher data also received from the cipher chunk analysis unit 151. The decoding logic 152 transfers the audio and video obtained by decoding the cipher data to the output unit 14.

[0043] The decoding key prefetching unit 153 obtains the decoding key corresponding to the key ID received from the cipher chunk analysis unit 151 from the key management system 2. The decoding key obtained by the decoding key prefetching unit 153 is stored in a data table 1541 (to be described later) in the decoding key storage unit 154 together with the key ID.

[0044] The decoding key storage unit 154 is an area such as a main memory that can be accessed quickly from the decoding logic 152. The decoding key storage unit 154 stores a data table 1541 that stores the decoding keys obtained by the decoding key prefetching unit 153 together with the key IDs. Note that the configuration of the data table 1541 is common to the aforementioned data table 1231 (see FIG. 3).

[0045] Figure 5 is a flowchart showing the processing of the encrypted communication application 1.

[0046] When the encrypted communication application 1 is started, it accepts from the user the specification of the encrypted communication application 1 of the communication destination and the key management system 2 (S101).

[0047] Subsequently, in the encrypted communication application 1, the key prefetching unit 124 of the encryption processing unit 12 starts prefetching the key from the specified key management system 2 (S102). The prefetching of the key from the key management system 2 by this key prefetching unit 124 is continuously executed while the encrypted communication application 1 is operating.

[0048] Thereafter, the encrypted communication application 1 enters a standby state until data is input to the input unit 11 or the reception unit 16 (S103). If audio or video is input to the input unit 11 from the computer's microphone or camera (S104: YES), transmission processing is executed (S105). If the reception unit 16 receives encrypted data from another encrypted communication application 1 (S106: YES), reception processing (S107) and output by the output unit 14 are performed (S108). When the encrypted communication application 1 completes the transmission processing (S105), or the reception processing (S107) and the output by the output unit 14 (S108), it returns to the standby state (S103).

[0049] Subsequently, the details of the key prefetching process starting from S102, the transmission process of S105, and the reception process of S107 will be described below.

[0050] Figure 6 is a flowchart showing the details of the key prefetching process by the key prefetching unit 124.

[0051] The key prefetching unit 124 first obtains an encryption key and a key ID from the key management system 2 using a communication protocol exemplified by ETSI GS QKD014 (S201). The information such as the destination required at this time has already been input in step S101 of the flowchart of the encrypted communication application shown in FIG. 5.

[0052] The encryption key pre-reading unit 124 acquires the encryption key and the key ID from the key management system 2 in the data format shown in, for example, FIG. 7, and adds them to the encryption key storage unit 123 (stores them in the data table 1231) in the data format shown in FIG. 3 (S202). At this time, the encryption key pre-reading unit 124 decodes the key data from the Base64 format into the original byte sequence, and sets the offset information to 0. Further, the encryption key pre-reading unit 124 may convert the key ID from the UUID format into an integer value.

[0053] At this point, the encryption key pre-reading unit 124 checks the number of keys stored in the encryption key storage unit 123 and compares it with a predetermined upper limit number (S203). If the number of keys has reached the upper limit (S203: YES), the encryption key pre-reading unit 124 temporarily stops the process, waits for a certain period of time (S204), and then returns to S203 to check the number of keys again. If the number of keys has not reached the upper limit (S203: NO), the encryption key pre-reading unit 124 performs S201 and subsequent steps again.

[0054] FIG. 8 is a flowchart showing the details of the transmission process (FIG. 5: S105) of the encrypted communication application 1.

[0055] First, when the input unit 11 inputs voice or video, it encodes this to generate a video / audio stream (S301). Further, the input unit 11 divides the stream into chunks in units such as time or frames (S302). This is called streaming processing and is a common process when performing real-time transfer of video / audio.

[0056] Subsequently, the input unit 11 inputs the audio / video divided into chunks to the encryption processing unit 12 (S303).

[0057] After performing the encryption process (FIG. 8) described later, the encryption processing unit 12 formats it as an encrypted chunk (FIG. 12) (S304).

[0058] After that, the transmission unit 13 transmits the encrypted chunk (S305). The communication protocol at this time is arbitrary. For example, RTP (Real-time Transport Protocol) or SRTP (Secure Real-time Transport Protocol) may be used.

[0059] FIG. 9 is a flowchart showing details of the encryption process by the encryption processing unit 12.

[0060] First, when the encryption processing unit 12 receives an input of an audio / video chunk, it checks whether key data of a length necessary for encryption is stored in the encryption key storage unit 123 (S401).

[0061] When there is sufficient key data in the encryption key storage unit 123 (S401: YES), the encryption processing unit 12 acquires an encryption key from the encryption key storage unit 123 (S402), and deletes the acquired encryption key from the encryption key storage unit 123, or updates offset information when only a partial byte sequence in the encryption key is acquired (S403).

[0062] Subsequently, the encryption processing unit 12 encrypts the audio / video chunk by the encryption logic 121 (S404). Also, the encryption logic 121 acquires a list of key IDs in the encryption key storage unit 123 (S405). This is for adding (embedding) as a pre-read key ID when formatting an encrypted chunk (FIG. 12) in a process (S406) by the encrypted chunk generation unit 122, which will be described in detail later. The encryption processing unit 12 formats the encrypted chunk by the encrypted chunk generation unit 122 (S406), and finally outputs the encrypted chunk to the transmission unit 13 (S407), and ends the encryption process.

[0063] On the other hand, when there is not enough key data in the encryption key storage unit 123 (S401: NO), the encryption processing unit 12 discards the input data (S408) and ends the encryption process (S448). However, if the delay time due to the encryption process is not a problem, S401 may be retried after waiting for the key data to be accumulated.

[0064] Figure 10 is a flowchart showing details of the reception process (Fig. 5: S107) of the encrypted communication application 1.

[0065] First, when the receiving unit 16 receives an encrypted chunk, it inputs this to the decryption processing unit 15 (S501). The decryption processing unit 15 performs decryption processing on the input encrypted chunk to generate an audio / video chunk (S502).

[0066] Subsequently, the decryption processing unit 15 generates a stream from the audio / video chunk (S503). The decryption processing unit 15 transfers the generated stream to the output unit 14.

[0067] When the output unit 14 receives a stream from the decryption processing unit 15, it outputs audio from the speaker and also displays video on the display (S504).

[0068] Figure 11 is a flowchart showing details of the decryption processing by the decryption processing unit 15.

[0069] First, when the decryption processing unit 15 receives an input of an encrypted chunk, the encrypted chunk analysis unit 151 analyzes the encrypted chunk to obtain a decryption key ID and a look-ahead key ID (S601).

[0070] Subsequently, the decryption processing unit 15 notifies the decryption key look-ahead unit 153 of the obtained look-ahead key ID and requests look-ahead of the decryption key (S602). In response to this, the decryption key look-ahead unit 153 obtains a decryption key that matches the look-ahead key ID from the key management system 2 (S651). The procedure for storing the obtained decryption key in the decryption key storage unit 154 is the same as the procedure described in detail in the encryption key look-ahead processing by the encryption key look-ahead unit 124 (see Fig. 6).

[0071] This look-ahead processing (S651, S652) of the decryption key is executed asynchronously with the decryption process of the decryption processing unit 15. That is, the decryption processing unit 15 transitions to the next process without waiting for the completion of the look-ahead processing, and acquires a decryption key that matches the decryption key ID from the decryption key storage unit 154 (S603).

[0072] When the acquisition of the decryption key from the decryption key storage unit 154 is successful (S604: YES), the decryption processing unit 15 deletes the acquired decryption key from the decryption key storage unit 154 (updates the offset information when only a partial byte sequence in the decryption key is acquired) (S605), and decrypts the encrypted payload portion of the encrypted chunk by the decryption logic 152 (S606). The decryption processing unit 15 outputs the decrypted audio / video chunk to the output unit 14 (S607) and ends the decryption process.

[0073] On the other hand, when the decryption key cannot be acquired from the decryption key storage unit 154 (S604: NO), the decryption processing unit 15 discards the input data (S608) and ends the decryption process.

[0074] FIG. 12 is a diagram showing an example of a data table of encrypted chunks generated by the encryption processing unit.

[0075] The encrypted payload corresponds to the audio / video chunk encrypted using the random number sequence of the encryption key.

[0076] Both the decryption key ID and the offset information are necessary information for decrypting the encrypted payload. The decryption key ID is the same as the encryption key ID of the encryption key used for encryption, and the offset information specifies the start position in the encryption key of the random number sequence used for encryption. Also, since there may be a case where the encrypted payload is encrypted using a concatenated random number sequence of multiple encryption keys, multiple decryption key IDs and offset information can be specified, and the data table of the encrypted chunk has these count information (the number of decryption key IDs).

[0077] The pre-reading key ID is the encryption key pre-read by the encryption key storage unit 123 of the encryption communication application 1 on the sending side, and is a list of IDs of decryption keys that the encryption communication application 1 on the receiving side should pre-read from now on. At this time, since the list of pre-reading key IDs has a variable length, the data table of the encrypted chunk has count information (the number of pre-reading key IDs) to specify its length.

[0078] As described above, in the encryption communication system 100 of the embodiment, while receiving the benefit of improved communication speed by pre-reading keys, there is no need to use a special communication protocol between the encryption communication applications 1 (between the encryption communication application [1]1 and the encryption communication application [2]1). Therefore, encryption using encryption keys and decryption keys shared by the quantum key distribution technology (QKD) in various communication applications can be utilized.

[0079] That is, the encryption communication system 100 of the embodiment can achieve high-speed communication by pre-reading keys without requiring a communication protocol for notifying key IDs, etc.

[0080] By the way, in the encryption communication system 100 of the embodiment, when the encryption communication application 1 on the sending side formats an encrypted chunk for transmitting the encrypted data and the ID of the encryption key used for encrypting the encrypted data to the encryption communication application 1 on the receiving side, the ID of the decryption key that the encryption communication application 1 on the receiving side should pre-read is embedded. Regarding the ID of the decryption key to be pre-read and embedded in this encrypted chunk, for example, the ID of the decryption key to be pre-read may be embedded in the encrypted chunk so that some of the IDs of the decryption keys to be pre-read overlap between the encrypted chunks transmitted and received sequentially in time series.

[0081] For example, in the encryption communication application 1 on the sending side, when encryption keys with key IDs 1 to 6 are pre-read, the IDs 1 to 4 may be embedded in the first encrypted chunk, and the IDs 3 to 6 may be embedded in the second encrypted chunk. In this case, 3 and 4 among 1 to 6 are duplicated and embedded in two encrypted chunks. In this case, if packet loss occurs in the first or second encrypted chunk, all of the IDs of the decryption keys to be pre-read included in that encrypted chunk will be unreachable. However, for some of the IDs, recovery will be performed in other encrypted chunks.

[0082] That is, the encrypted communication system 100 of the embodiment can reduce the possibility that the pre-read key ID becomes unreachable when the encrypted communication application does not perform retransmission control by adjusting the range and number of embedded key IDs and embedding the same pre-read key ID in a plurality of encrypted chunks.

[0083] Although some embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the gist of the invention. These embodiments and their modifications are included in the scope and gist of the invention, and are included in the invention described in the claims and its equivalent scope.

Explanation of Reference Numerals

[0084] 1... Encrypted communication application, 2... Key management system, 3... QKD device, 11... Input unit, 12... Encryption processing unit, 13... Transmission unit, 14... Output unit, 15... Decryption processing unit, 16... Reception unit, 100... Encrypted communication system, 121... Encryption logic, 122... Encrypted chunk generation unit, 123... Encryption key storage unit, 124... Processing unit, 151... Encrypted chunk analysis unit, 152... Decryption logic, 154... Decryption key storage unit, 1231, 1541... Data table.

Claims

A cryptographic communication system in which a transmitting device and a receiving device perform cryptographic communication using a cryptographic key managed by a key management system, The key management system has an interface that notifies a key ID when providing a cryptographic key and returns the cryptographic key corresponding to the key ID in response to a request for the cryptographic key specified by the key ID, and shares the cryptographic key between a first site and a second site by quantum key distribution technology, The transmitting device acquires a cryptographic key managed by the key management system from the first site, The receiving device acquires a cryptographic key managed by the key management system from the second site, In the cryptographic communication system, The transmitting device, Encryption logic that encrypts plaintext data using a cryptographic key acquired from the key management system, A key prefetching unit that acquires from the key management system a cryptographic key for encrypting the plaintext data before the input of the plaintext data, A cryptographic key storage unit that stores the cryptographic key acquired by the key prefetching unit together with the key ID, A packet in which first encrypted data obtained by encrypting first plaintext data using a first cryptographic key and a first key ID of the first cryptographic key are stored, and a second key ID of a second cryptographic key stored in the cryptographic key storage unit, which is used for encrypting second plaintext data transmitted after the first plaintext data, is embedded, and an encrypted chunk generation unit that generates the packet, Comprising, The receiving device, Decryption logic that decrypts encrypted data using a cryptographic key acquired from the key management system, An encrypted chunk analysis unit that analyzes the packet and reads the second key ID, A decryption key prefetching unit that acquires from the key management system the second cryptographic key corresponding to the second key ID read by the encrypted chunk analysis unit, A decryption key storage unit that stores the cryptographic key acquired by the decryption key prefetching unit together with the key ID, A cryptographic communication system comprising.

2. The encrypted chunk generation unit, At the time of generating the packet, a plurality of key IDs of cryptographic keys used for encrypting plaintext data transmitted after the plaintext data transmitted in the packet are embedded in the packet, A part of the plurality of key IDs embedded in the packet transmitted at the first timing and the plurality of key IDs embedded in the packet transmitted at the second timing subsequent to the first timing are overlapped, When the decryption key prefetching unit stores the encryption key corresponding to the key ID read by the encryption chunk analysis unit in the decryption key storage unit, the decryption key prefetching unit discards the key ID read by the encryption chunk analysis unit. The encryption communication system according to claim 1.

3. The encryption communication system according to claim 1 or 2, wherein the interface is an interface compliant with the ETSI GS QKD014 specification.

4. An encryption communication device that obtains an encryption key from a key management system, encrypts plaintext data to be transmitted, and transmits the encrypted data obtained by the encryption. The key management system has an interface that notifies a key ID when providing an encryption key and returns the encryption key corresponding to the key ID in response to a request for the encryption key specified by the key ID, and shares the encryption key between two points by quantum key distribution technology. The encryption communication device Encryption logic that encrypts plaintext data using the encryption key obtained from the key management system, A decryption key prefetching unit that obtains an encryption key for encrypting the plaintext data from the key management system before the input of the plaintext data, A decryption key storage unit that stores the encryption key obtained by the decryption key prefetching unit together with the key ID, A packet in which the first encrypted data obtained by encrypting the first plaintext data using the first encryption key by the encryption logic and the first key ID of the first encryption key are stored, and which is used for encrypting the second plaintext data transmitted after the first plaintext data. An encrypted chunk generation unit that generates a packet in which the second key ID of the second encryption key stored in the encrypted key storage unit is embedded. An encryption communication device comprising:

5. The encrypted chunk generation unit At the time of generating the packet, a plurality of key IDs of the encryption key used for encrypting the plaintext data transmitted after the plaintext data transmitted in the packet are embedded in the packet, Overlapping a part of the plurality of key IDs embedded in the packet transmitted at the first timing and the plurality of key IDs embedded in the packet transmitted at the second timing subsequent to the first timing. The encryption communication device according to claim 4.

6. An encryption communication device that obtains an encryption key from a key management system and decrypts the received encrypted data. The key management system has an interface that notifies a key ID when providing an encryption key and returns the encryption key corresponding to the key ID in response to a request for the encryption key specified by the key ID, and shares the encryption key between two locations by quantum key distribution technology. The encrypted communication device has decryption logic for decrypting encrypted data using an encryption key obtained from the key management system, a packet in which first encrypted data that can be decrypted using a first encryption key and a first key ID of the first encryption key are stored, and analyzes a packet in which a second key ID of a second encryption key that can decrypt second encrypted data transmitted after the first encrypted data is embedded, and reads the second key ID. An encrypted chunk analysis unit, a decryption key prefetch unit that obtains the second encryption key corresponding to the second key ID read by the encrypted chunk analysis unit from the key management system, a decryption key storage unit that stores the encryption key obtained by the decryption key prefetch unit together with the key ID, An encrypted communication device comprising:

7. The decryption key prefetch unit discards the key ID read by the encrypted chunk analysis unit when the encryption key corresponding to the key ID read by the encrypted chunk analysis unit is stored in the decryption key storage unit. The encrypted communication device according to claim 6.

8. The interface is an interface compliant with the ETSI GS QKD014 specification. The encrypted communication device according to any one of claims 4 to 7.

9. An encrypted communication system in which a transmission device and a reception device perform encrypted communication using an encryption key managed by a key management system, The key management system has an interface that notifies a key ID when providing an encryption key and returns the encryption key corresponding to the key ID in response to a request for the encryption key specified by the key ID, and shares the encryption key between a first location and a second location by quantum key distribution technology. The transmission device obtains an encryption key managed by the key management system from the first location, The receiving device obtains an encryption key managed by the key management system from the second location. In an encrypted communication method executed in an encrypted communication system, The transmitting device encrypts plaintext data using an encryption key obtained from the key management system, obtains an encryption key for encrypting the plaintext data from the key management system before inputting the plaintext data, stores the obtained encryption key together with the key ID, A packet storing first encrypted data obtained by encrypting first plaintext data using a first encryption key and a first key ID of the first encryption key, and embedding a second key ID of a second encryption key stored therein, which is used for encrypting second plaintext data transmitted after the first plaintext data, to generate a packet. Comprising The receiving device Decrypting the encrypted data using an encryption key obtained from the key management system Analyzing the packet to read the second key ID Obtaining the second encryption key corresponding to the read second key ID from the key management system Storing the obtained encryption key together with the key ID An encrypted communication method comprising **Claim 10**: An encrypted communication system in which a transmitting device and a receiving device perform encrypted communication using an encryption key managed by a key management system, The key management system has an interface that notifies a key ID when providing an encryption key and returns the encryption key corresponding to the key ID in response to a request for an encryption key specified by the key ID, and shares an encryption key between a first site and a second site by quantum key distribution technology. The transmitting device obtains an encryption key managed by the key management system from the first site. The receiving device obtains an encryption key managed by the key management system from the second site. In a program applied to an encrypted communication system, Regarding the transmitting device Encryption logic for encrypting plaintext data using an encryption key obtained from the key management system A key prefetching unit that obtains an encryption key for encrypting the plaintext data from the key management system before the input of the plaintext data A key storage unit that stores the encryption key obtained by the key prefetching unit together with the key ID An encryption chunk generation unit that generates a packet storing first encrypted data obtained by encrypting first plaintext data using a first encryption key and a first key ID of the first encryption key, and embedding a second key ID of a second encryption key stored in the key storage unit, which is used for encrypting second plaintext data transmitted after the first plaintext data Functioning as Regarding the receiving device Decryption logic for decrypting encrypted data using an encryption key obtained from the key management system An encryption chunk analysis unit that analyzes the packet to read the second key ID A decryption key pre-reader that obtains the second encryption key corresponding to the second key ID read by the cipher chunk analysis unit from the key management system, A decryption key storage unit that stores the encryption key obtained by the decryption key pre-reader together with the key ID, A program for causing it to function as such.

Images