Communication system and communication method

Abstract

The present invention prevents key exchange from being performed except with a pair of the latest short-term public key and counterpart identification information, when using ID-based cryptographic technology.　A client terminal 7 receives a first long-term private key and a prescribed nonce received from a KGC server 3 and based on the latest time (S23), uses the first long-term private key to generate a first short-term private key and a first short-term public key (S24), and transmits, to a prescribed server, the first short-term public key and terminal identification information to which a first nonce is added and which is for identifying the client terminal (S25). A prescribed server 5 receives a second long-term private key and the prescribed nonce received from the KGC server 3 (S12), confirms, on the basis of whether or not the first nonce transmitted by the first transmission process is the same as the prescribed nonce, whether or not the first nonce is based on the latest time (S26), and does not generate a second short-term public key if the first nonce is not based on the latest time (S27).

Description

[Technical Field]

[0001] The present disclosure relates to a communication system and a communication method. [Background technology]

[0002] While passwords and digital certificates have been known as authentication technologies for IoT (Internet of Things) devices, in recent years there has been a demand for the introduction of more secure authenticated key exchange protocols. Authenticated key exchange protocols generate a mutually shared key (common key) upon successful authentication, enabling encrypted communication using that common key. One such authenticated key exchange protocol is known to use ID (identification)-based encryption.

[0003] The authenticated key exchange protocol using ID-based encryption uses an authenticated key exchange method in which the user's ID, an arbitrary string of characters of their choice, is used as the public key, and the manufacturing code or serial number of an IoT device can be used as the public key. Using this feature, the authenticated key exchange protocol using ID-based encryption allows client terminals to mutually authenticate each other to verify that their IDs are correct, and if authentication is successful, a shared common key (session key) can be generated, and the client terminals can then use that shared key to perform encrypted communication.

[0004] Furthermore, from the viewpoint of long-term operation, a revocation-enabled ID-based authenticated key exchange protocol (RIB-AKE) has been proposed as an ID-based authenticated key exchange protocol that adds the functionality of updating and invalidating long-term secret keys (Non-Patent Document 1). [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] Kohei Nakagawa, Toshimasa Wariki, Hiroki Okano, Jun Fujioka, Akira Nagai, "Highly Efficient ID-Based Authenticated Key Exchange with Revocation Function", 2022 Symposium on Cryptography and Information Security Summary of the Invention [Problem to be solved by the invention]

[0006] However, the above-mentioned conventional technology has a problem in that even if the long-term private key is updated, both parties can continue to use the old long-term private key for key exchange.

[0007] The present invention has been made in consideration of the above points, and aims to provide an authenticated key exchange protocol using ID-based encryption in which key exchange can only be performed using a pair of the latest long-term private key and the other party's identification information. [Means for solving the problem]

[0008] In order to achieve the above object, the invention of claim 1 is a communication system having a predetermined server and a client terminal that perform encrypted communication using an ID-based encryption method, wherein the client terminal has a first receiving unit that receives a predetermined nonce based on the latest time received from a KGC server and a first long-term private key, a first short-term key generation unit that generates a first short-term private key and a first short-term public key using the first long-term private key, and a first transmitting unit that transmits to the predetermined server terminal terminal identification information to which the first nonce is added and which identifies the client terminal, and the first short-term public key; and the predetermined server has a second receiving unit that receives the predetermined nonce and a second long-term private key received from the KGC server, a second verifying unit that verifies whether the first nonce is based on the latest time depending on whether the first nonce transmitted by the first transmitting unit is the same as the predetermined nonce, and a second short-term key generation unit that does not execute processing to generate a second short-term public key if the first nonce is not based on the latest time. [Effects of the Invention]

[0009] As described above, the present invention has the effect that key exchange can only be carried out using a pair of the latest long-term secret key and the other party's identification information. [Brief explanation of the drawings]

[0010] [Figure 1] 1 is a schematic diagram of a communication system according to an embodiment. [Figure 2] FIG. 2 is a hardware configuration diagram of a KGC server and a predetermined server according to an embodiment. [Figure 3] FIG. 2 is a hardware configuration diagram of a client terminal according to the embodiment. [Figure 4] FIG. 2 is a functional configuration diagram of the communication system according to the embodiment. [Figure 5] FIG. 10 is a sequence diagram showing a process in a steady state. [Figure 6] FIG. 10 is a sequence diagram showing processing during key exchange. [Figure 7] FIG. 10 is a sequence diagram showing processing during key exchange. [Figure 8] FIG. 10 is a sequence diagram showing processing during key exchange. DETAILED DESCRIPTION OF THE INVENTION

[0011] [Overall structure] Fig. 1 is a schematic diagram of a communication system according to an embodiment of the present invention. As shown in Fig. 1, the communication system 1 of this embodiment is constructed by a KGC server 3, a predetermined server 5, and a client terminal 7. Although Fig. 1 shows two components, the predetermined server 5 and the client terminal 7, there may be three or more. The client terminals include IoT devices, tablet terminals, notebook PCs, etc.

[0012] Furthermore, the KGC server 3, the predetermined server 5, and the client terminal 7 can communicate via a communication network 100 such as the Internet. The connection form of the communication network 100 may be either wireless or wired. The KGC server 3 is composed of one or more computers. The KGC server may also be referred to as the "KGC system."

[0013] The KGC server 3 is a server of a KGC (Key Generation Center: ID-based key generation station) and issues long-term private keys and the like.

[0014] The predetermined server 5 and the client terminal 7 perform mutual authentication using ID-based encryption.

[0015] [Hardware configuration] <Hardware configuration of each server> First, the hardware configuration of the KGC server 3 and the predetermined server 5 will be described with reference to Fig. 2. Fig. 2 is a diagram showing the hardware configuration of the KGC server and the predetermined server.

[0016] 2, the KGC server 3 includes a processor 301, a memory 302, an auxiliary storage device 303, a connection device 304, a communication device 305, and a drive device 306. The hardware components constituting the KGC server 3 are connected to each other via a bus 307.

[0017] The processor 301 serves as a control unit that controls the entire KGC server 3, and includes various computing devices such as a CPU (Central Processing Unit). The processor 301 reads and executes various programs on the memory 302. The processor 301 may also include a GPGPU (General-purpose computing on graphics processing units).

[0018] The memory 302 has a main storage device such as a ROM (Read Only Memory), a RAM (Random Access Memory), etc. The processor 301 and the memory 302 form a so-called computer, and the processor 301 executes various programs read onto the memory 302, thereby enabling the computer to realize various functions.

[0019] The auxiliary storage device 303 stores various programs and various information used when the processor 301 executes the various programs.

[0020] The connection device 304 is a connection device that connects an external device (for example, a display device 310, an operation device 311) and the KGC server 3.

[0021] The communication device 305 is a communication device for transmitting and receiving various types of information to and from other devices (including equipment, servers, and systems).

[0022] The drive device 306 is a device for loading a recording medium 330. The recording medium 330 here includes media that record information optically, electrically, or magnetically, such as a CD-ROM (Compact Disc Read-Only Memory), a flexible disk, a magneto-optical disk, etc. The recording medium 330 may also include semiconductor memory that records information electrically, such as a ROM (Read Only Memory), a flash memory, etc.

[0023] The various programs to be installed in the auxiliary storage device 303 are installed, for example, by setting the distributed recording medium 330 in the drive device 306 and reading the various programs recorded on the recording medium 330 by the drive device 306. Alternatively, the various programs to be installed in the auxiliary storage device 303 may be installed by being downloaded from a network via the communication device 305.

[0024] Also, although the hardware configuration of the predetermined server 5 is shown in FIG. 2, since each configuration is the same except that the reference numbers change from the 300s to the 500s, these descriptions are omitted.

[0025] <Hardware Configuration of IoT Devices and Tablet Terminals> Next, the hardware configuration of the client terminal 7 will be described using FIG. 3. FIG. 3 is a hardware configuration diagram of a client terminal (IoT device, tablet terminal, etc.) according to an embodiment. Note that the client terminal 7 does not necessarily have to have the configuration shown in FIG. 3.

[0026] As shown in FIG. 3, the client terminal 7 includes a processor 701, a memory 702, an auxiliary storage device 703, a communication device 704, and a GPS (Global Positioning System) device 705. The client terminal 7 also includes a voice input device 706, a voice output device 707, a display device 708, an imaging device 709, a connection device 710, and a short-range wireless communication device 711. Each hardware component that constitutes the client terminal 7 is interconnected via a bus 720.

[0027] The processor 701 serves as a control unit that controls the entire client terminal 7 and has various arithmetic devices such as a CPU (Central Processing Unit). The processor 701 reads out and executes various programs on the memory 702. Note that the processor 401 may include a GPGPU (General-purpose computing on graphics processing units).

[0028] The memory 702 includes main memory devices such as a ROM (Read Only Memory) and a RAM (Random Access Memory). The processor 701 and the memory 702 form a so-called computer, and by the processor 701 executing various programs read out on the memory 702, the computer realizes various functions.

[0029] The auxiliary storage device 703 stores various programs and various information used when the various programs are executed by the processor 701.

[0030] The communication device 704 is a communication device for transmitting and receiving various information to and from other devices (including devices, servers, and systems). The GPS device 705 detects the position information of the client terminal 7.

[0031] The voice input device 706 detects voice information such as the user's voice and ambient sounds. The voice output device 707 is a device that outputs various information received from other devices as voice, for example.

[0032] The display device 708 is a device that displays various information received from other devices as an image, for example.

[0033] The imaging device 709 captures the user and the surroundings and generates image information.

[0034] The connection device 710 is a connection device used to connect various sensors, external memories, etc. to the client terminal 7.

[0035] The short-range wireless communication device 711 is a wireless device for performing short-range wireless communication with other devices near the client terminal 7.

[0036] Note that the predetermined server 5 may have the configuration shown in FIG. 3 instead of the configuration shown in FIG. 2. 〔Functional Configuration of Communication System〕 Subsequently, the functional configuration of the communication system will be described using FIG. 4. FIG. 4 is a functional configuration diagram of the communication system according to the embodiment.

[0037] <Functional Configuration of KGC Server 3> The KGC server 3 has a transceiver unit 31, a long-term private key generation unit 33, and an authentication unit 35. Each of these units is a function that the processor 301 causes the KGC server 3 to realize using one or more programs installed in the KGC server 3. The KGC server 3 also has a storage unit 30. The storage unit 30 is realized by a memory 302 or an auxiliary storage device 303. As shown in FIG. 5, the storage unit 30 registers IDs and authentication methods for the predetermined server 5 and each client terminal 7A, 7B. The client terminals 7A, 7B are an example of a client terminal 7. Although FIG. 5 illustrates three terminals, the predetermined server 5 and each client terminal 7A, 7B, this is not limiting. The server ID of the predetermined server 5 (server1@example.com) is abbreviated as "IDs." The client ID of the client terminal 7A (alice@example.com) is abbreviated as "IDa." The client ID of the client terminal 7B (bob@example.com) is abbreviated as "IDb."

[0038] The transmitter / receiver 31 transmits and receives data to and from the predetermined server 5 and the client terminal 7 via the communication network 100. For example, the transmitter / receiver 31 updates the long-term private key (SSK_S) by transmitting to the predetermined server 5 the long-term private key (SSK_S) generated using the server IDs to which a nonce based on the latest time T is added (nonced), thereby updating the long-term private key (SSK_S). Note that the "nonce" is also called a "nonce." Because the KGC server 3 manages a master time such as UNIX (registered trademark) time, the transmitter / receiver 31 can always transmit the long-term private key (SSK_S) of the latest time T at a predetermined time interval agreed upon between the predetermined server 5 and the client terminal 7. The transmitter / receiver 31 also transmits a nonce based on the latest time T along with the long-term private key (SSK_S). For example, in FIG. 5 , in "SSK(server1@example.com+1648490000)," "server1@example.com" is the server ID of the predetermined server 5, and "1648490000" is the nonce. The nonce is generated using, for example, the latest time T. In this embodiment, ID-based authentication key exchange can be performed any number of times within the validity period.

[0039] In addition, in response to a request from the client terminal 7A, the transmitting and receiving unit 31 transmits the long-term private key (SSK_A) generated by the long-term private key generation unit 33 to the client terminal 7A. In addition, in response to a request from the client terminal 7B, the transmitting and receiving unit 31 transmits the long-term private key (SSK_B) generated by the long-term private key generation unit 33 to the client terminal 7B. The transmitting and receiving unit 31 also transmits a nonce based on the latest time T together with the long-term private key (SSK_A) or the long-term private key (SSK_B). The long-term private key (SSK_S) is specifically shown as "SSK(server1@example.com_1648490000)" in FIG. 5 and subsequent figures. The long-term private key (SSK_A) is specifically shown as "SSK(alice@example.com_1648490000)" in FIG. 6 and subsequent figures. Furthermore, the long-term private key (SSK_B) can be specifically represented as “SSK(bob@example.com_1648490000).” The nonce “1648490000” is changed based on the latest time T.

[0040] The long-term private key generation unit 33 generates a long-term private key (SSK_S) after adding a nonce to the server ID of the specified server 5 at a specified update interval (for example, one minute) agreed upon between the specified server 5 and the client terminal 7, based on the master time managed by the KGC server 3. The long-term private key generation unit 33 also generates a long-term private key (SSK_A) after adding a nonce to the terminal IDa of the client terminal 7A. The long-term private key generation unit 33 also generates a long-term private key (SSK_B) after adding a nonce to the terminal IDb of the client terminal 7B.

[0041] When the transmitting / receiving unit 31 receives a request to generate a long-term private key from the client terminal 7, the authentication unit 35 authenticates the client terminal 7 using a predetermined authentication method from among the authentication methods already registered in the memory unit 30.

[0042] <Functional configuration of a given server> The predetermined server 5 has a transmitting / receiving unit 51, a verification unit 52, a short-term key generation unit 54, and a symmetric key generation unit 57. Each of these units is a function that the processor 501 causes the predetermined server 5 to realize using one or more programs installed in the predetermined server 5. The predetermined server 5 also has a storage unit 50. The storage unit 50 is realized by a memory 502 or an auxiliary storage device 503. The storage unit 50 stores server IDs, which are an example of server identification information for identifying the predetermined server 5 itself. The storage unit 50 also stores the nonce and long-term secret key (SSK_S) at the latest time T sent from the KGC server 3.

[0043] The transmitting / receiving unit 51 transmits and receives data to and from the KGC server 3 and the client terminal 7 via the communication network 100. For example, the transmitting / receiving unit 51 constantly receives the nonce and long-term private key (SSK_S) of the latest time T from the KGC server 3. The transmitting / receiving unit 51 also transmits to the client terminal 7A its own (predetermined server 5) server ID with the nonce added, and the short-term public key (EPK_S) generated by the short-term key generation unit 54.

[0044] The confirmation unit 52 confirms whether the nonce added to the terminal IDa / IDb sent from the client terminal 7 is the same as the nonce based on the latest time T sent from the KGC server 3, thereby confirming whether the nonce added to the terminal IDa / IDb is the latest. In this case, if the nonce is the same, it is the latest. If it is not the terminal ID with the latest time, the confirmation unit 52 informs the short-term key generation unit 54 that it is not the terminal ID with the latest time, and the short-term key generation unit 54 does not generate a short-term public key, and the transmission / reception unit 51 ends communication with the client terminal 7. On the other hand, if it is the terminal ID with the latest time, the confirmation unit 52 informs the short-term key generation unit 54 that it is the terminal ID with the latest time, causing the short-term key generation unit 54 to start generating a short-term public key.

[0045] The short-term key generation unit 54 generates a short-term private key (ESK_S) based on its own long-term private key (SSK_S) received from the KGC server 3, its own server IDs with a nonce attached, and the terminal IDa / IDb of the client terminal 7 with a nonce attached, and generates a short-term public key (EPK_S) that pairs with this short-term private key (ESK_S), thereby generating a short-term key pair.

[0046] The common key generation unit 57 generates a common key (session key) for performing encrypted communication with the client terminal 7 using the ID-based encryption method, using its own long-term private key (SSK_S), terminal IDa / IDb with a nonce attached, server IDs with a nonce attached, short-term public keys (EPK_A / EPK_B) sent from the client terminal 7, and short-term private keys (ESK_A / ESK_B) corresponding to the short-term public keys (EPK_A / EPK_B).

[0047] <Client terminal functional configuration> The client terminal 7 has a transmitting / receiving unit 71, a confirmation unit 72, a short-term key generation unit 74, and a symmetric key generation unit 77. Each of these units is a function that the processor 701 causes the client terminal 7 to realize using one or more programs installed in the client terminal 7. The client terminal 7 also has a storage unit 70. The storage unit 70 is realized by a memory 702 or an auxiliary storage device 703. The storage unit 70 stores a terminal ID, etc., which is an example of terminal identification information for identifying the client terminal 7 itself (the client terminal 7).

[0048] The transmitting / receiving unit 71 transmits and receives data to and from the KGC server 3 and the predetermined server 5 via the communication network 100. For example, the transmitting / receiving unit 71 transmits its own (client terminal 7) terminal IDa / IDb with a nonce added and its own short-term public keys (EPK_A / EPK_B) to the predetermined server 5. The terminal ID of the client terminal 7a is indicated as terminal IDa, and the terminal ID of the client terminal 7b is indicated as terminal IDb.

[0049] The confirmation unit 72 confirms the nonce added to the server IDs received by the transmission / reception unit 71. If the server ID is not the latest server ID, the confirmation unit 72 notifies the symmetric key generation unit 77 that it is not the latest server ID, the symmetric key generation unit 77 does not generate a symmetric key, and the transmission / reception unit 71 ends communication with the predetermined server 5. On the other hand, if the server ID is the latest server ID, the confirmation unit 72 notifies the symmetric key generation unit 77 that it is the latest server ID, and the symmetric key generation unit 77 starts generating a symmetric key.

[0050] The short-term key generation unit 74 adds a nonce based on the latest time T received by the transmission / reception unit 71 to its own terminal IDa / IDb and the server ID of the predetermined server 5 that has been acquired in advance. The short-term key generation unit 74 then generates short-term private keys (ESK_A / ESK_B) based on its own long-term private keys (SSK_A / SSK_B) received from the KGC server 3, its own terminal IDa / IDb with the nonce based on the latest time T added, and the server ID of the predetermined server 5 with the nonce based on the latest time T added, and generates short-term public keys (EPK_A / EPK_B) that pair with the short-term private keys (ESK_A / ESK_B), thereby generating a short-term key pair. The short-term public key of client terminal 7A is shown as short-term public key (EPK_A), and the short-term public key of client terminal 7B is shown as short-term public key (EPK_B). In addition, the short-term private key of the client terminal 7A is indicated as a short-term private key (ESK_A), and the short-term private key of the client terminal 7B is indicated as a short-term private key (ESK_B).

[0051] If the verification unit 72 determines that the server IDs are the latest, the common key generation unit 77 generates a common key (session key) for performing encrypted communication with the specified server 5 using the ID-based encryption method, using its own long-term private key (SSK_A / SSK_B), its own terminal IDa / IDb with the nonce attached, the server IDs with the nonce attached, the short-term public key (EPK_S) sent from the specified server 7, and the short-term private key (ESK_S) corresponding to the short-term public key (EPK_S).

[0052] [Processing or Operation of the Embodiment] Next, the processing or operation of the communication system 1 will be described with reference to Fig. 5 to Fig. 8. In this embodiment, a case will be described in which the predetermined server 5 and the client terminal 7a, which is an example of the client terminal 7, perform encrypted communication using the ID-based encryption method.

[0053] <Steady-state processing> S11: As shown in Figure 5, the long-term private key generation unit 33 of the KGC server 3 generates a long-term private key (SSK_S) for the latest time T based on server IDs with a nonce based on the latest time T attached at a predetermined update interval (e.g., 1 minute).

[0054] S12: The transmitter / receiver 31 of the KGC server 3 continues to transmit, at a predetermined update interval, to the predetermined server 5, a nonce based on the latest time T and the long-term private key (SSK_S) for the latest time T generated by the long-term private key generation unit 33. As a result, the transmitter / receiver 51 of the predetermined server 5 continues to receive, at a predetermined update interval, the nonce based on the latest time T and the long-term private key (SSK_S).

[0055] <Key exchange process> S21: As shown in Fig. 6, the transmitter / receiver 71 of the client terminal 7A transmits a request to generate a long-term private key for itself (the client terminal 7A) to the KGC server 3. At this time, the terminal IDa of the client terminal 7A is also transmitted. As a result, the transmitter / receiver 31 of the KGC server 3 receives the request to generate a long-term private key.

[0056] S22: The authentication unit 35 of the KGC server 3 performs authentication using the authentication method registered in the storage unit 30.

[0057] S23: If the authentication determines that the client terminal 7A is a valid terminal, the long-term private key generation unit 33 generates a long-term private key (SSK_A) by adding a nonce based on the latest time T to the terminal IDa of the client terminal 7A at a predetermined update interval (for example, one minute) agreed upon between the predetermined server 5 and the client terminal 7, based on the master time managed by the KGC server 3. Then, the transmission / reception unit 31 transmits to the client terminal 7A the nonce based on the latest time T and the long-term private key (SSK_A) for the latest time T generated by the long-term private key generation unit 33. As a result, the transmission / reception unit 71 of the client terminal 7A receives the nonce based on the latest time T and the long-term private key (SSK_A). Note that if the authentication determines that the client terminal 7A is a valid terminal, the transmission / reception unit 31 notifies the client terminal 7A that the authentication has failed.

[0058] S24: The short-term key generation unit 74 of the client terminal 7A adds a nonce based on the latest time T received by the transmission / reception unit 71 to its own terminal IDa and the server ID of the predetermined server 5 that has been acquired in advance. The short-term key generation unit 74 then generates a short-term private key (ESK_A) using its own long-term private key (SSK_A) received from the KGC server 3, its own terminal IDa with the nonce based on the latest time T added, and the server ID of the predetermined server 5 with the nonce based on the latest time T added, and generates a short-term public key (EPK_A) that pairs with this short-term private key (ESK_A), thereby generating a short-term key pair.

[0059] S25: The transmitter / receiver 71 of the client terminal 7A transmits its own (client terminal 7A) terminal IDa with the nonce added and its own short-term public key (EPK_A) to the predetermined server 5. As a result, the transmitter / receiver 51 of the predetermined server 5 receives the terminal IDa with the nonce added and the short-term public key (EPK_A).

[0060] S26: As shown in FIG. 7, the confirmation unit 52 of the specified server 5 confirms whether the nonce attached to the terminal IDa received in process S25 is the latest by checking whether the nonce attached to the terminal IDa is the same as the nonce based on the latest time T received in process S12.

[0061] S27: If the nonce added to the terminal IDa is the latest, the short-term key generation unit 54 of the predetermined server 5 adds a nonce based on the latest time T received by the transmission / reception unit 71 to its own server IDs and the terminal IDa of the client terminal 7A that was acquired in advance. The short-term key generation unit 54 then generates a short-term private key (ESK_S) using its own long-term private key (SSK_S) received from the KGC server 3, the terminal IDa to which the nonce based on the latest time T has been added, and the server IDs to which the nonce based on the latest time T has been added, and generates a short-term public key (EPK_S) that pairs with this short-term private key (ESK_S), thereby generating a short-term key pair. Note that if the nonce added to the terminal IDa is not the latest, the predetermined server 5 does not perform processes S27 and S28.

[0062] S28: The transmitter / receiver 51 also transmits its own (predetermined server 5) server ID with the nonce added and its own short-term public key (EPK_S) to the client terminal 7 A. As a result, the transmitter / receiver 51 of the client terminal 7 A receives the server ID with the nonce added and the short-term public key (EPK_S).

[0063] S29: As shown in FIG. 8, the confirmation unit 72 of the client terminal 7A confirms whether the nonce attached to the server IDs received in process S28 is the latest by checking whether the nonce attached to the client terminal IDs is the same as the nonce based on the latest time T received in process S23.

[0064] S30: If the nonce added to the server IDs is the latest, the symmetric key generation unit 77 of the client terminal 7A uses its own long-term private key (SSK_A), its own terminal IDa with the nonce added, the server IDs with the nonce added, the exchanged short-term public key (EPK_S), and the short-term private key (ESK_S) corresponding to the short-term public key (EPK_S) to generate a symmetric key (session key) for performing encrypted communication with the predetermined server 5 using the ID-based encryption method. Also, on the predetermined server 5 side, after process S27, the symmetric key generation unit 57 uses its own long-term private key (SSK_S), the terminal IDa with the nonce added, the server IDs with the nonce added, the short-term public key (EPK_A) sent from the predetermined server 5, and the short-term private key (ESK_A) corresponding to the short-term public key (EPK_A) to generate a symmetric key (session key) for performing encrypted communication with the client terminal 7A using the ID-based encryption method.

[0065] [Major Effects of the Embodiments] As described above, according to this embodiment, if the terminal ID and server ID were not generated based on the latest time T (see S26, S29), the exchange of short-term public keys between the predetermined server 5 and the client terminal 7 will fail. Furthermore, even if the terminal ID and server ID were generated based on the latest time T, the exchange of short-term public keys will fail unless the short-term public key (EPK_S) (see S27) was generated using the legitimate long-term private key (SSK_S) (see S12) of the predetermined server 5 and the short-term public keys (EPK_A / EPK_B) (see S24) were generated using the legitimate long-term private keys (SSK_A / SSK_B) (see S22, S23) of the client terminal 7. This makes it possible to prevent the exchange of old short-term public keys.

[0066] Moreover, by performing authentication using the registered authentication method (S22), the KGC server 3 can provide a long-term private key only to an authorized client terminal 7. Furthermore, by allowing multiple authentication methods, the KGC server 3 can provide services tailored to the needs of the user of the client terminal 7.

[0067] 〔supplement〕 The present invention is not limited to the above-described embodiment, and may have the following configurations or processes (operations).

[0068] The KGC server 3, the predetermined server 5, and the client terminal 7 can also be realized by a computer and a program, but this program can also be recorded on a (non-temporary) recording medium or provided via a network such as the Internet. [Explanation of symbols]

[0069] 1. Communication Systems 3 KGC Server 5. Designated Server 7. Client terminal 51 Transmitting / receiving unit (an example of a second transmitting unit, an example of a second receiving unit) 52 Confirmation unit (an example of a second confirmation unit) 54 Short-term key generation unit (an example of a second short-term key generation unit) 57 Shared key generation unit (an example of a second shared key generation unit) 71 Transmitting / receiving unit (an example of a first transmitting unit, an example of a first receiving unit) 72 confirmation unit (an example of a first confirmation unit) 74 Short-term key generation unit (an example of a first short-term key generation unit) 77 Common key generation unit (an example of a first common key generation unit) 100 Communication Network

Claims

1. A communication system having a predetermined server and a client terminal that perform encrypted communication using an ID-based encryption method, The client terminal a first receiving unit that receives a predetermined nonce based on the latest time received from a KGC server and a first long-term private key; a first short-term key generation unit that generates a first short-term private key and a first short-term public key using the first long-term private key; a first transmitting unit that transmits, to the predetermined server, terminal identification information to which a first nonce is added and which identifies the client terminal, and the first short-term public key; and The predetermined server a second receiving unit that receives the predetermined nonce and a second long-term private key from a KGC server; a second confirmation unit that confirms whether the first nonce transmitted by the first transmission unit is the same as the predetermined nonce, and thereby confirms whether the first nonce is based on the latest time; a second short-term key generation unit that does not execute a process of generating a second short-term public key if the first nonce is not based on the latest time; A communication system comprising:

2. 2. The communication system of claim 1, the second short-term key generation unit generates a second short-term private key and the second short-term public key using the second long-term private key when the first nonce is based on the latest time; The predetermined server a second transmission unit that transmits to the client terminal server identification information to which a second nonce is added for identifying the predetermined server, and the second short-term public key; a second symmetric key generation unit that generates a symmetric key based on the terminal identification information, the server identification information, the second long-term private key, and the first short-term public key; and The client terminal a first confirmation unit that confirms whether the second nonce transmitted by the second transmission unit is the same as the predetermined nonce, and thereby confirms whether the second nonce is based on the latest time; a first symmetric key generation unit that does not execute a process of generating the symmetric key when the first nonce is not based on the latest time; A communication system comprising:

3. the first symmetric key generation unit generates the symmetric key based on the terminal identification information, the server identification information, the first long-term private key, and the second short-term public key when the first nonce is based on the latest time. The communication system according to claim 2 .

4. The client terminal the first transmitting unit requests the KGC server to generate the first long-term private key; the first receiving unit receives the first long-term secret key generated and transmitted after the client terminal is authenticated by the KGC server; A communication system according to any one of claims 1 to 3.

5. The predetermined server the second receiving unit receives the predetermined nonce generated and transmitted by the KGC server at predetermined time intervals based on the latest time; A communication system according to any one of claims 1 to 3.

6. A communication method executed by a communication system having a predetermined server and a client terminal that perform encrypted communication using an ID-based encryption method, comprising: The client terminal a first receiving process for receiving a predetermined nonce based on the latest time received from a KGC server and a first long-term private key; a first short-term key generation process for generating a first short-term private key and a first short-term public key using the first long-term private key; a first transmission process of transmitting terminal identification information to which a first nonce is added for identifying the client terminal and the first short-term public key to the predetermined server; Run The predetermined server a second receiving process for receiving the predetermined nonce and a second long-term private key from a KGC server; a second confirmation process for confirming whether the first nonce transmitted by the first transmission process is the same as the predetermined nonce, and whether the first nonce is based on the latest time; a second short-term key generation process that does not execute a process for generating a second short-term public key if the first nonce is not based on the latest time; A communication method that performs the following.

7. 7. The communication method according to claim 6, the second short-term key generation process includes a process of generating a second short-term private key and the second short-term public key using the second long-term private key when the first nonce is based on the latest time; The predetermined server a second transmission unit that transmits to the client terminal server identification information to which a second nonce is added for identifying the predetermined server, and the second short-term public key; a second symmetric key generation process for generating a symmetric key based on the terminal identification information, the server identification information, the second long-term private key, and the first short-term public key; Run The client terminal a first confirmation process for confirming whether the second nonce transmitted by the second transmission unit is the same as the predetermined nonce, and whether the second nonce is based on the latest time; a first symmetric key generation process that does not execute a process for generating the symmetric key if the first nonce is not based on the latest time; A communication method that performs the following.

8. the first symmetric key generation process includes a process of generating the symmetric key based on the terminal identification information, the server identification information, the first long-term private key, and the second short-term public key when the first nonce is based on the latest time. The communication method according to claim 7.

Images