Key sharing manager device and its program

Abstract

To provide a key sharing manager device capable of managing a group by assigning specific authority to a manager of the group sharing a key.SOLUTION: A key sharing manager device 1 includes: signature verification key generation means 11 for generating a signature key and a verification key for an electronic signature; encryption key generation means 12 for generating private keys and public keys in association with identifiers of a manager and a plurality of members; encryption key distribution means 14 for distributing a member's private key in response to a request from a member whose identifier matches; group generation means 150 for generating a message to notify all the members of the manager's public key and the members' public key; and signature addition means 16 for generating a signature for the message using the signature key, adding the signature to the message, and transmitting the signed message to all the members.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to a key sharing manager device and the Regarding the program. [Background technology]

[0002] In recent years, video conferencing applications such as Zoom (registered trademark) and messenger applications such as LINE (registered trademark) have become widely used both in Japan and overseas. However, for example, the Ministry of Internal Affairs and Communications' 2020 Information and Communications White Paper pointed out vulnerabilities in video conferencing applications, making security assurance a critical issue. Zoom and LINE use end-to-end (E2E) encryption to ensure security between users' devices. The technology for sending and receiving messages safely using E2E encryption is called secure messaging. There are various E2E encryption methods, a typical example being the Signal protocol (Non-Patent Document 1). Note that Zoom and LINE each use their own unique E2E encryption technology (Non-Patent Documents 2 and 3).

[0003] E2E encryption can be broadly divided into two steps. One is for users to share a public key (key agreement). The other is for messages to be encrypted using a private key corresponding to the shared public key. The Internet Engineering Task Force (IETF), an Internet standards organization, is working on standardization of secure messaging and is promoting the standardization of Continuous Key Agreement (CKA) technology, which has higher security and efficiency (Non-Patent Document 4). CKA technology is one of the key agreement technologies, and is characterized by its ability to enable long-term communication sessions and the ability for users to share private keys asynchronously. However, the CKA technique only allows keys to be shared among a set of users, and does not allow keys to be shared among a group. In response to this, Alwen et al. proposed Continuous Group Key Agreement (CGKA) technology in 2020, which allows multiple users to share a common key (Non-Patent Document 5). CGKA also uses a public key infrastructure (PKI), a trusted third-party organization, as the organization that distributes keys. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] M. Marlinspike and T. Perrin, "The Double Ratchet Algorithm", https: / / whispersystems.org / docs / specifications / doubleratchet / doubleratchet.pdf, November 20, 2016. [Non-patent document 2] J. Blum, S. Booth, O. Gal, M. Krohn, J. Len, K. Lyons, A. Marcedone, M. Maxim, M. Ember Mou, J. O'Connor, S. Rien, M. Steele, M. Green, L Kissner, and A. Stamos, "https: / / github.com / zoom / zoom-e2e-whitepaper / blob / master / archive / zoom_e2e_v3.pdf", Zoom Video Communications, Inc., December 15, 2020 [Non-patent document 3] "LINE Encryption Overview Technical Whitepaper." https: / / scdn.line-apps.com / stf / linecorp / en / csr / line-encryption-whitepaper-ver2.0.pdf, LINE Corporation, October 28, 2019 [Non-patent document 4] Alwen, J., Coretti, S., & Dodis, Y. (2019, May). "The double ratchet: security notions, proofs, and modularization for the signal protocol." In Annual International Conference on the Theory and Applications of Cryptographic Techniques (pp. 129-158). Springer, Cham. [Non-Patent Document 5] Alwen, J., Coretti, S., Dodis, Y., & Tselekounis, Y. (2020, August). "Security analysis and improvements for the IETF MLS standard for group messaging." In Annual International Cryptology Conference (pp. 248-277). Springer, Cham. Summary of the Invention [Problem to be solved by the invention]

[0005] Conventional E2E encryption methods, such as LINE's Letter Sealing feature that encrypts and sends messages, make it easy to add or remove users, but they are inefficient because the shared key must be recreated from scratch every time a user is added or removed. On the other hand, CGKA is a technology that allows multiple users to share a private key, eliminating the need to recreate a shared key from scratch like with LINE and allowing for flexible changes to the member structure. However, like the E2E encryption method, CGKA basically treats multiple users as equals, and anyone can add or delete other users, which poses a risk of impersonation. CGKA also uses a public key infrastructure, with keys distributed by a trusted third party. However, if a trusted third party commits a malicious act, it is not possible to prevent information leakage, etc.

[0006] The present invention has been made in view of the above problems, and provides a key sharing manager device and a method for managing a group in which one user (one terminal device) is designated as a group manager and is granted authority that other users (other terminal devices) do not have, without requiring a trusted third party to manage the group. the The objective is to provide a program. [Means for solving the problem]

[0007] In order to solve the above problem, the key sharing manager device of the present invention is a key sharing manager device in a key sharing system consisting of one key sharing manager device that serves as a manager of a group for sharing keys used to encrypt data, and multiple key sharing member devices that are members of the group, and is configured to include a signature verification key generation means, an encryption key generation means, an encryption key distribution means, a group generation means, and a signature addition means.

[0008] In this configuration, the key sharing manager generates a signature key and a verification key for an electronic signature by means of the signature verification key generating means. The key sharing manager device then generates a private key and a public key of a public key cryptosystem by using an encryption key generating means, in association with the identifiers of the manager and the member. Furthermore, the key sharing manager device distributes the member's private key by means of the encryption key distribution means in response to a request from a member with a matching identifier. This allows the private and public keys to be generated and managed by the group manager without the use of a third party.

[0009] The key sharing manager device then sets the private keys and public keys of the manager and members generated by the encryption key generation means in state variables using the group generation means. This allows the key sharing manager device to share the public key of the entire group in the state variables. Furthermore, the key sharing manager device can generate a message using the group generation means to notify all members of the manager's public key and the member's public keys.

[0010] The key sharing manager device then uses the signature key to generate a signature for the message generated by the group generation device, attaches the signature to the message, and transmits the signed message to all members. This message enables the key sharing member devices to share the public key of the entire group. Furthermore, since the message is signed, the key sharing manager device is authorized to create a group.

[0011] The key sharing manager may also authorize a message to add a member, a message to delete a member, or a message to update a state variable by attaching a signature to these messages. The key sharing manager device can be operated by a key sharing manager program that causes a computer to function as each of the above-mentioned means. [Effects of the Invention]

[0016] The present invention provides the following excellent effects. According to the present invention, it is possible to provide authority using a digital signature to a specific user (manager) while realizing the conventional flexible key sharing. Furthermore, according to the present invention, since a public key infrastructure is not used, the risk of information leakage can be reduced. This allows the present invention to realize highly secure one-to-many group secure messaging. [Brief explanation of the drawings]

[0017] [Figure 1] 1 is a system configuration diagram showing the overall configuration of a key sharing system including a key sharing manager device and key sharing member devices according to an embodiment of the present invention. [Figure 2] 1 is a block diagram showing a configuration of a key sharing manager device according to an embodiment of the present invention; [Figure 3] FIG. 10 is an explanatory diagram for explaining the structure of a ratchet tree, which is a state variable. [Figure 4] 2 is a block diagram showing the internal configuration of a message generating means in FIG. 1. FIG. [Figure 5] FIG. 10 is an explanatory diagram illustrating the correspondence between a ratchet tree and an identifier, a public key, and a private key. [Figure 6] 1 is a block diagram showing a configuration of a key sharing member device according to an embodiment of the present invention. [Figure 7] FIG. 7 is a block diagram showing the internal configuration of a message generating means in FIG. 6. [Figure 8] 10 is a flowchart illustrating an operation of an initialization process of the key sharing system according to the embodiment of the present invention. [Figure 9] 10 is a flowchart illustrating an operation of a group generation process of the key sharing system according to the embodiment of the present invention. [Figure 10A] 10 is a flowchart showing the operation of the key sharing manager device and the key sharing member device of an added member when the key sharing manager device is the adding executor, among the operations of the member addition process of the key sharing system according to the embodiment of the present invention. [Figure 10B]10 is a flowchart showing the operation of the key sharing manager device and key sharing member devices other than the added member when the key sharing manager device is the adding executor, in the member addition process of the key sharing system according to the embodiment of the present invention. [Figure 10C] 10 is a flowchart showing the operation of the member addition process of the key sharing system according to the embodiment of the present invention when the key sharing member device is an addition executor. [Figure 10D] 10D is a flowchart showing the operation of the key sharing member device of the added member after the operation of FIG. 10C. [Figure 10E] 10D is a flowchart showing the operations of the key sharing manager device and key sharing member devices other than the added member after the operation of FIG. 10C. [Figure 11] 10 is a flowchart showing the operation of a member deletion process of the key sharing system according to the embodiment of the present invention. [Figure 12A] 10 is a flowchart showing the operation of the state update process of the key sharing system according to the embodiment of the present invention when the key sharing manager device is the update executor. [Figure 12B] 10 is a flowchart showing the operation of the state update process of the key sharing system according to the embodiment of the present invention when a key sharing member device is an update executor. DETAILED DESCRIPTION OF THE INVENTION

[0018] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. [Configuration of key sharing system] First, the configuration of a key sharing system 100 will be described with reference to FIG. The key sharing system 100 shares a key used to encrypt data among the terminal devices that make up a group, and manages the group by granting one terminal device that serves as the group manager authority that is not available to the other terminal devices that are group members. The keys used for encryption are an encryption key (public key) and a decryption key (private key) for data when distributing various data such as video and music within a group set in advance on the network N. That is, the key sharing system 100 is an application that functions on a system that distributes data. Here, a description of data distribution will be omitted and the key sharing system will be described in detail.

[0019] The key sharing system 100 comprises a key sharing manager device 1, a key sharing member device 2, and an authentication and distribution server 3, which are connected via a network N. One key sharing manager device 1 and multiple key sharing member devices 2, 2, ... form one group. The authentication and distribution server 3 is not limited to this group, but is a server that can also function for other groups. The key sharing manager device 1 and the key sharing member devices 2 download application software for data distribution from a server (not shown) and execute the software to implement their respective functions.

[0020] The key sharing manager device 1 is a terminal device that forms a group together with multiple key sharing member devices 2, 2, ..., shares an encryption key, and also serves as the manager (administrator) of the group. The key sharing manager device 1 sends and receives control messages (hereinafter simply referred to as messages) to and from the key sharing member devices 2 to create groups, add and delete members, and update the group status.

[0021] For example, the key sharing manager device 1 is a terminal device managed by a broadcasting company that broadcasts programs, a distribution company that distributes video and audio, etc. When remotely distributing programs, etc., the key sharing manager device 1 forms a group of pre-registered key sharing member devices 2, 2, ... and shares a key.

[0022] The key sharing manager device 1 also has the function of generating a public key (encryption key) pk and a private key (decryption key) sk corresponding to the identifier (ID) of a terminal device, and recording them in association with the ID. When a terminal device with an identifier ID requests a public key pk' corresponding to another identifier ID', the key sharing manager device 1 notifies the public key pk'. When a terminal device with an identifier ID requests a private key sk corresponding to its own identifier ID, the key sharing manager device 1 notifies the private key sk. Although one key sharing manager device 1 is shown here, there may be a plurality of key sharing manager devices 1 according to the number of groups formed in the key sharing system 100. The configuration of this key sharing manager device 1 will be described later.

[0023] The key sharing member devices 2 are terminal devices that become members of a group that shares encryption keys under the management of the key sharing manager device 1. For example, the key sharing member devices 2 are terminals that view programs distributed by broadcasting companies or distribution companies. Sharing an encryption key means that the entire group shares a public key corresponding to a private key secretly held by each member. Here, the key sharing member devices 2, 2, ... are illustrated as belonging to the same group, but there are also multiple key sharing member devices 2 that belong to different groups and multiple key sharing member devices 2 that belong to different groups in the key sharing system 100. The configuration of these key sharing member devices 2 will be described later.

[0024] The authentication and distribution server 3 is a server that distributes identifiers (IDs) and delivers key information to terminal devices (key sharing manager device 1, key sharing member devices 2) on the network N that run data distribution applications such as video distribution and music distribution. Here, the authentication and distribution server 3 assigns IDs to users participating in the application by authenticating their phone numbers, etc. The authentication and distribution server 3 also relays messages related to key sharing between the terminal devices (key sharing manager device 1, key sharing member devices 2).

[0025] Furthermore, here, the authentication and distribution server 3 further has a function of collecting IDs of users who wish to join a group when the group is formed in an application, and notifying the key sharing manager device 1, which is the manager of the preset group. Note that this collection of IDs does not necessarily have to be performed by the authentication and distribution server 3, but may be performed between terminal devices (key sharing manager device 1, key sharing member devices 2).

[0026] Also, here, the authentication and distribution server 3 distributes a verification key for the electronic signature generated by the key sharing manager device 1 to the key sharing member devices 2, 2, . . . The configurations of the key sharing manager device 1 and the key sharing member devices 2 that make up the key sharing system 100 will be described below.

[0027] [Configuration of the key sharing manager device] First, the configuration of the key sharing manager device 1 will be described with reference to FIG. The key sharing manager device 1 includes an initialization means 10, a signature verification key generation means 11, an encryption key generation means 12, a storage means 13, an encryption key distribution means 14, a message generation means 15 (including a group generation means 150 (Figure 4) etc.), a signature addition means 16, and a message processing means 17.

[0028] The initialization means 10 initializes state variables that hold key information shared by the key sharing manager device 1 (manager) and the key sharing member devices 2 (members). The initialization means 10 acquires its own ID (here, ID0 of the manager) from the authentication and distribution server 3 and performs initialization processing. This initialization processing is a process of inputting the user's ID (ID0) and outputting the state variable γ according to the initialization algorithm (γ←init(ID)) of the CGKA protocol.

[0029] The state variable γ is a variable that records at least the group's own identifier ID, and the identifier IDs and key pairs (public key, private key) of the members that make up the group. Note that the private keys stored in the state variable γ are only those corresponding to the group's own identifier ID, and the private keys of other members are not stored. The ID and key pair in this state variable γ are recorded in a tree structure of a ratchet tree (RT).

[0030] The structure of the RT will now be described with reference to Fig. 3. The RT is a left-balanced binary tree (LBBT) in which the child node on the left side of the root node R has a complete binary tree structure. For example, the child node C1 on the left side of the root node R and below form a complete binary tree structure. Also, the child node C2 on the right side of the root node R and below form an LBBT, and the child node C3 on the left side of C2 and below form a complete binary tree structure. Here, the total number of nodes in RT (including the root node) is set to n, and the total number of the root node R and the nodes of the complete binary tree on the left side of the root node R is set to x. n nodes with LBBT (LBBT n ) is configured, and LBBT (LBBT n-x ) is constructed, where x is the largest power of 2 among the divisors of n. In the CGKA protocol, an ID and a key pair (public key, private key) are associated with each leaf node of an RT. Returning to FIG. 2, the configuration of the key sharing manager device 1 will be explained further.

[0031] The initialization means 10 sets its own ID0 to the state variable γ and initializes the RT. The initialization means 10 stores the initialized state variable γ in the storage means 13. The initialization means 10 also notifies the signature verification key generation means 11 of the completion of the initialization.

[0032] The signature verification key generation means 11 generates a private key for electronic signature (signature key sk sig ) and the public key for verification (verification key vk sig ) and generate After initialization by the initialization means 10, the signature verification key generation means 11 generates a signature key and a verification key from security parameters having a preset key length. Note that the method for generating the signature key and the verification key is a general digital signature technique, and therefore a description thereof will be omitted. The signature verification key generation means 11 generates the signature key sk sig is stored in the storage means 13, and the generated verification key vk sig is sent to the authentication and distribution server 3. This generates the verification key vk sig is registered in the authentication and distribution server 3 and distributed to the key sharing member devices 2, 2, . . .

[0033] The encryption key generation means 12 generates a private key (decryption key) sk and a public key (encryption key) pk, which are a key pair in a public key cryptosystem for encrypting / decrypting data, in association with the identifiers of the manager and multiple members. Note that the method for generating the key pair is a generation method in a general public key cryptosystem, and therefore a description thereof will be omitted. This encryption key generation means 12 generates a public key pk and a private key sk by inputting the identifier (ID) of the terminal device from the encryption key distribution means 14 or the message generation means 15, and stores them in the storage means 13 in association with the ID.

[0034] The storage means 13 stores the state variable γ and the signature key sk sig , as well as the public key pk and the private key sk for each identifier ID. The storage means 13 can be configured with a general storage device such as a semiconductor memory. The state variable γ stored in the storage means 13 is initialized by the initialization means 10 and updated by the message generation means 15 and the message processing means 17 . Also, the signature key sk stored in the storage means 13 sig is generated by the signature verification key generation means 11 and is referred to by the signature addition means 16. The public key pk and secret key sk for each identifier ID stored in the storage means 13 are generated by the encryption key generation means 12 and are referenced by the encryption key distribution means 14 and the message generation means 15 .

[0035] The encryption key distribution means 14 receives a request including an identifier ID from a key sharing member device 2 that is a member of a group that shares a key, and distributes the corresponding key. When the encryption key distribution means 14 receives a request (public key request) for the public key of another identifier ID' from the key sharing member device 2 with the identifier ID, it reads the public key corresponding to ID' from the storage means 13 and distributes it to the key sharing member device 2 with the identifier ID.

[0036] When the encryption key distribution means 14 receives a request (public key request) for a public key of an unknown identifier ID" that will become an additional member of the group from a key sharing member device 2 with identifier ID, the encryption key generation means 12 generates a public key and a private key corresponding to ID" and distributes the generated public key to the key sharing member device 2 with identifier ID". When the encryption key distribution means 14 receives a request for a key update (key update request) from the key sharing member device 2 with identifier ID, the encryption key generation means 12 generates a public key and a private key corresponding to ID and distributes them to the key sharing member device 2 with identifier ID. Furthermore, the encryption key distribution means 14 distributes the private key of a key sharing member device 2 that is a member of a key sharing group in response to a request (private key request) from a key sharing member device 2 that has a matching identifier.

[0037] The message generating means 15 generates a message (control message) of the CGKA protocol to be sent to the key sharing member device 2 that is a member of the group that shares the key. Here, the internal configuration of the message generating means 15 will be described with reference to FIG. 4 (and also with reference to FIG. 2 as appropriate). The message generating means 15 includes a group generating means 150 , a member adding means 151 , a member deleting means 152 , and a status updating means 153 .

[0038] The group generation means 150 sets the private keys and public keys of the manager and multiple members generated by the encryption key generation means 12 in the state variable γ as key information, and generates a message notifying all members of the manager's public key and the members' public keys. Here, the group generation means 150 generates a group in which members (key sharing member devices 2, 2, . . . ) who wish to participate in the group share key information. The group generation means 150 acquires the identifiers ID (group G=(ID1, ID2, ...)) of the members (key sharing member devices 2, 2, ...) who wish to join the group from the authentication and distribution server 3, and generates a group generation message. The generation process of this group generation message is carried out using the group generation algorithm ((γ′,T cre )←create(γ,G)) inputs the state variable γ stored in the storage means 13 and the group member identifiers G=(ID1, ID2, . . . ), updates the state variable γ to γ′, and sends the group creation message T cre This is the process of generating

[0039] Specifically, the group generation means 150 uses the encryption key generation means 12 to generate a public key pk0 and a secret key sk0 of a public key cryptosystem that correspond to its own identifier ID0. Furthermore, the group generation means 150 generates, by the encryption key generation means 12, each identifier ID of G=(ID1, ID2, . . . ) which is the identifier of the group members. i The public key pk corresponding to i Generate (pk1,pk2,…).

[0040] As shown in FIG. 5, the group generation means 150 associates its own identifier ID0, public key pk0, and secret key sk0 with the 0th leaf node Ln0 of RT of the state variable γ. Furthermore, the group generation means 150 associates an identifier ID1 and a public key pk1 with the first leaf node Ln1 of RT. Thereafter, the group generation means 150 associates the identifier ID and public key pk of a group member with the leaf node Ln. Note that in FIG. 5, "⊥" indicates that a predetermined initial value is set. As a result, the group generation means 150 updates the state variable γ and generates a new state variable γ′. The group generation means 150 stores the new state variable γ′ in the storage means 13.

[0041] In addition, the group generation means 150 adds its own identifier ID0 to the group member identifiers G=(ID1, ID2, ...) to generate G'=(ID0, ID1, ID2, ...), and adds its own public key pk0 to the group member public keys pk=(pk1, pk2, ...) to generate pk'=(pk0, pk1, pk2, ...). The group generation means 150 generates a group generation message T containing the identifier G′ of the generated group member and the public key pk′ of the group member. cre Generate. The group generation means 150 generates a group generation message T cre is output to the signature adding means 16.

[0042] When a member is added to a group, the member addition means 151 generates a private key and a public key for the member to be added using the encryption key generation means 12, sets the generated public key of the member to a state variable γ that stores key information, and generates a message to notify all members of the added key information. The member addition means 151 acquires the identifier ID' of a new member (key sharing member device 2) who wishes to join the group, and generates a member addition message. The process of generating this member addition message is carried out in accordance with the member addition algorithm ((γ',T add )←add(γ, ID′)) inputs the state variable γ stored in the storage means 13 and the identifier ID′ of the member to be added, updates the state variable γ to γ′, and sends a member addition message T addThis is the process of generating

[0043] Specifically, the member addition means 151 acquires an identifier ID' of a new member (key sharing member device 2) who wishes to join the group from the authentication and distribution server 3 or via an input means (not shown). The member addition means 151 also generates a private key sk' and a public key pk' corresponding to the identifier ID' using the encryption key generation means 12. Then, the member addition means 151 adds an empty leaf node (for example, the leaf node Ln in FIG. 5) to which a member has not yet been set in the RT of the state variable γ. X If there is no free leaf node in RT, the member addition means 151 adds a leaf node to RT and associates the identifier ID' with the public key pk'. As a result, the member addition means 151 updates the state variable γ and generates a new state variable γ′. The member addition means 151 stores the new state variable γ′ in the storage means 13. The member addition means 151 also sends a member addition message T add Generate. The member addition means 151 receives a member addition message T add is output to the signature adding means 16.

[0044] When a specified member is deleted, the member deletion means 152 deletes the key information (public key) of the member to be deleted from the state variable γ, and generates a message to notify all members of the deleted key information. The member deletion means 152 acquires the identifier ID' of the member (key sharing member device 2) designated for deletion from within the group, and generates a member deletion message. The generation process of this member deletion message is carried out in accordance with the member deletion algorithm ((γ',T rem )←rem(γ, ID′)) inputs the state variable γ stored in the storage means 13 and the identifier ID′ (deletion ID) of the member to be deleted, updates the state variable γ to γ′, and sends a member deletion message T remThis is the process of generating

[0045] Specifically, the member deletion means 152 acquires the identifier ID' of the member (key sharing member device 2) to be deleted from the group from the authentication and distribution server 3 or via input means (not shown). Then, the member deleting means 152 sets the leaf node corresponding to the identifier ID' of the RT of the state variable γ as a free leaf node. As a result, the member deletion means 152 updates the state variable γ and generates a new state variable γ′. The member deletion means 152 stores the new state variable γ′ in the storage means 13. The member deletion means 152 also sends a member deletion message T rem Generate. The member deletion means 152 sends a member deletion message T rem is output to the signature adding means 16.

[0046] When updating key information, the state update means 153 generates a new private key and public key for the manager, sets them in the state variable γ, and also generates a message to notify all members of the generated public key. The state update means 153 generates a state update message when updating its own key information, that is, a key pair (public key, private key). The generation process of this state update message is performed according to the state update algorithm ((γ′,T upd )←upd(γ)) inputs the state variable γ stored in the storage means 13, updates the state variable γ to γ′, and sends a state update message T upd This is the process of generating

[0047] Specifically, when the state update means 153 is instructed to update the state variables via an input means (not shown), the encryption key generation means 12 generates a new public key pk and secret key sk for the public key cryptography. The state update means 153 updates the public key pk and the private key sk of the leaf node corresponding to its own identifier ID in the RT of the state variable γ. As a result, the state update means 153 updates the state variable γ and generates a new state variable γ′. The state update means 153 stores the new state variable γ′ in the storage means 13. The state update means 153 also sends a state update message T upd Generate. The state update means 153 sends a state update message T upd is output to the signature adding means 16. Returning to Figure 2, we continue the explanation.

[0048] The signature adding means 16 adds a signature key sk sig The signature for the message is generated and attached to the message using the above, and the signed message is sent to the member. Here, the signature adding means 16 adds the message T (group generating message T cre ,Member addition message T add ,Member deletion message T rem ,State update message T upd ) and add a signature (digital signature). The signature adding means 16 calculates a hash value for the message using a predetermined hash function, and adds the signature key sk stored in the storage means 13 to the message. sig The signature σ is generated by encrypting the

[0049] Then, the signature adding means 16 generates a signed message (T, σ) by adding the signature σ to the message T, and transmits it to the group members (key sharing member devices 2, 2, ...) via the authentication and distribution server 3. The group members can be identified by the identifiers associated with the leaf nodes of RT of the state variable γ. Therefore, the signature adding means 16 instructs the authentication and distribution server 3 to distribute the signed message (T, σ) to the key sharing member devices 2, 2, ..., specifying the identifiers ID of the group members. As a result, the signed message (T, σ) is delivered to the group members via the authentication and delivery server 3.

[0050] The message processing means 17 receives a message (control message) of the CGKA protocol from a key sharing member device 2 that is a member of a group that shares a key, and performs processing corresponding to the message. The processing corresponding to this message is to input the state variable γ stored in the storage means 13 and the message T according to the message processing algorithm ((γ',I)←proc(γ,T)) of the CGKA protocol, and update the state variable γ to γ'. It is assumed here that the key sharing member device 2 does not have the authority to create a group or delete a member. That is, the key sharing member device 2 sends a member addition message T add , state update message T upd Only the following shall be received:

[0051] Specifically, the message processing means 17 receives the member addition message T add When receiving a member addition message T add The public key pk' corresponding to the identifier ID' of the additional member included in the table is read from the storage means 13. Then, the message processing means 17 selects an empty leaf node (for example, the leaf node Ln in FIG. 5) in which a member of the RT of the state variable γ has not yet been set. X If there is no free leaf node in RT, the message processing means 17 adds a leaf node to RT and associates the identifier ID' with the public key pk'. As a result, the message processing means 17 updates the state variable γ and generates a new state variable γ'.

[0052] The message processing means 17 also processes the status update message T upd When receiving a member addition message T add A new state variable γ′ is generated by setting a new public key pk to the leaf node corresponding to the identifier ID of the RT of the state variable γ from the identifier ID and public key pk included in the state variable γ. The message processing means 17 stores the new state variable γ′ in the storage means 13 .

[0053] With the configuration described above, the key sharing manager device 1 can share key information with the key sharing member devices 2, 2, ... that make up a group. Furthermore, by adding a signature to a message, the key sharing manager device 1 can be given authority to create a group, etc., thereby realizing one-to-many secure group messaging. Furthermore, the key sharing manager device 1 generates a private key and a public key by the public key cryptosystem using the encryption key generating means 12, so that keys can be shared within a group, and information leakage can be prevented. The key sharing manager device 1 can be operated by a program (key sharing manager program) that causes a computer to function as each of the above-mentioned means.

[0054] [Configuration of key sharing member devices] Next, the configuration of the key sharing member device 2 will be described with reference to FIG. The key sharing member device 2 comprises an initialization means 20, a verification key acquisition means 21, a storage means 22, a message generation means 23, an encryption key acquisition means 24, a signature verification means 25, and a message processing means 26.

[0055] The initialization means 20 initializes state variables that hold key information shared by the key sharing manager device 1 (manager) and the key sharing member devices 2 (members). The initialization means 20 acquires its own ID from the authentication and distribution server 3 and performs initialization processing. This initialization processing is a processing to input the user's ID and output the state variable γ according to the initialization algorithm (γ←init(ID)) of the CGKA protocol, and is the same processing as the initialization means 10 described in FIG. 2. The initialization means 20 stores the initialized state variable γ in the storage means 22 .

[0056] The verification key acquisition means 21 acquires a public key (verification key vk) for verifying the digital signature generated by the key sharing manager device 1. sig ) is obtained. The verification key acquisition means 21 acquires the verification key vk sig is stored in the storage means 22.

[0057] The storage means 22 stores the state variable γ and the verification key vk sig The storage means 22 can be configured with a general storage device such as a semiconductor memory. The state variable γ stored in the storage means 22 is initialized by the initialization means 20 and updated by the message generation means 23 and the message processing means 26 . Also, the verification key vk stored in the storage means 22 sig is stored by the verification key acquisition means 21 and is referred to by the signature verification means 25.

[0058] The message generating means 23 generates a message (control message) of the CGKA protocol to be sent to the key sharing manager device 1, which is the manager of the group that shares the key, and to other key sharing member devices 2 that are members of the group. The message generating means 23 instructs the authentication and distribution server 3 to distribute the generated message T to the group members (key sharing manager device 1, key sharing member devices 2, 2, . . . ) by specifying the identifiers ID of the group members.

[0059] Here, the internal configuration of the message generating means 23 will be described with reference to FIG. 7 (and also with reference to FIG. 6 as appropriate). The message generation means 23 comprises member addition means 231 and status update means 233. The group generation means 230 and member deletion means 232 in Fig. 7 are not necessary when a one-to-many secure group is formed with one key sharing manager device 1 and multiple key sharing member devices 2, 2, ... as shown in Fig. 1, with the key sharing manager device 1 as the manager. However, when a key sharing member device 2 forms an equal group with multiple other key sharing member devices 2, the message generation means 23 may be configured to comprise the group generation means 230 and member deletion means 232.

[0060] The group generation means 230, member addition means 231, member deletion means 232, and status update means 233 have basically the same functions as the group generation means 150, member addition means 151, member deletion means 152, and status update means 153 described in Figure 4, respectively, so only the differences will be described.

[0061] The group generation means 150 and the member addition means 151 have generated a public key pk0 and a secret key sk0 of a public key cryptosystem corresponding to their own identifier ID0 using the encryption key generation means 12. Meanwhile, the group generation means 230 and the member addition means 231 simply obtain a public key corresponding to their own ID from the key sharing manager device 1 using the encryption key acquisition means 24.

[0062] Furthermore, the state update means 153 has generated a public key pk0 and a private key sk0 of a public key cryptosystem corresponding to its own identifier ID0 using the encryption key generation means 12. Meanwhile, the state update means 233 uses the encryption key acquisition means 24 to request a key update from the key sharing manager device 1 and acquires the updated public key and private key. Returning to FIG. 6, the explanation continues.

[0063] The encryption key acquisition means 24 acquires a public key encryption key generated by the key sharing manager device 1 in response to a request including an identifier ID from the key sharing manager device 1, which is the manager of the group that shares the key. The encryption key acquisition means 24 transmits a request for a public key, a request for a private key, or a request for key update from the message generation means 23 to the key sharing manager device 1 and acquires the desired key. However, the encryption key acquisition means 24 can only acquire private keys with matching identifiers. The encryption key acquisition means 24 outputs the acquired key to the message generation means 23 .

[0064] The signature verification means 25 receives a signed message (T, σ) in which a signature σ is added to a message T from the key sharing manager device 1, which is the manager of the group that shares the key, and verifies the verification key vk sig The signature (electronic signature) is verified using the above. The signature verification means 25 calculates a hash value for the message T using the same hash function as the signature addition means 16 (FIG. 2). The signature verification means 25 also calculates the hash value for the message T by using the signature σ added to the message T with the verification key vk stored in the storage means 22. sig Decrypt with. Then, the signature verification means 25 verifies whether the signature σ is the signature of the key sharing manager device 1 by checking whether the hash value matches the decryption result.

[0065] If the signature verification means 25 verifies that the signature σ is the signature of the key sharing manager device 1, it outputs the message T to the message processing means 26. If the signature σ is not verified as the signature of the key sharing manager device 1, the signature verification means 25 discards the message T. When the signature verification means 25 receives a message T from another key sharing member device 2, it outputs the message T to the message processing means 26 even if the signature σ is not added.

[0066] The message processing means 26 performs processing corresponding to the message (control message). Here, the message processing means 26 updates the state variable γ with the key information contained in the message in a process corresponding to the message. The processing corresponding to this message is to input the state variable γ stored in the storage means 22 and the message T according to the message processing algorithm ((γ',I)←proc(γ,T)) of the CGKA protocol, and update the state variable γ to γ'.

[0067] Specifically, the message processing means 26 processes the group generation message T cre When a group creation message T cre The secret key sk corresponding to the identifier ID of the group shared by the group manager 1 is acquired by the encryption key acquisition means 24 from the key sharing manager 1. Then, the message processing means 26 sends the group creation message T cre Furthermore, the message processing means 26 associates the private key sk with the leaf node of RT corresponding to its own identifier ID.

[0068] The message processing means 26 also processes the member addition message T add When receiving a member addition message T add The process is changed depending on whether the identifier ID' of the added member included in is the identifier of the member itself, that is, whether the member itself is the added member or not.

[0069] If the identifier ID′ is the identifier of the member itself (if the member itself is an additional member), the message processing means 26 sends a member addition message T add The encryption key acquisition means 24 acquires from the key sharing manager device 1 the private key sk' that pairs with the public key pk' corresponding to its own identifier ID' included in the message γ. Then, the message processing means 26 associates the identifier ID', public key pk', and private key sk' with an empty leaf node in the RT of the state variable γ that has not yet been assigned a member. If there is no empty leaf node in the RT, the message processing means 26 adds a leaf node to the RT and associates the identifier ID', public key pk', and private key sk' with each other.

[0070] If the identifier ID' is not its own identifier (if it is not an added member), the message processing means 26 associates the identifier ID' with the public key pk' with an empty leaf node in the RT of the state variable γ to which no member has yet been set. If there is no empty leaf node in the RT, the message processing means 26 adds a leaf node to the RT and associates the identifier ID' with the public key pk'.

[0071] The message processing means 26 also processes the member deletion message T rem When a member deletion message T rem The leaf node of RT of the state variable γ corresponding to the identifier ID′ (deletion ID) included in is set as a free leaf node.

[0072] The message processing means 26 also processes the status update message T upd When receiving a member addition message T add A new state variable γ′ is generated by setting a new public key pk to the leaf node corresponding to the identifier ID of the RT of the state variable γ from the identifier ID and public key pk included in the state variable γ. The message processing means 26 stores the new state variable γ′ in the storage means 22 .

[0073] With the configuration described above, the key sharing member device 2 can share key information between the key sharing manager device 1 and the key sharing member devices 2, 2, ... that make up the group. Furthermore, by verifying the signature attached to the message, the key sharing member device 2 can grant the key sharing manager device 1 authority to create a group, etc., thereby realizing one-to-many secure group messaging. The key sharing member device 2 can be operated by a program (key sharing member program) that causes a computer to function as each of the above-mentioned means.

[0074] [Key sharing system operation] Next, the operation of the key sharing system 100 will be described with reference to the drawings. (initialization) First, the initialization process of the key sharing system 100 will be described with reference to FIG. 8 (for the configuration, refer to FIGS. 2 and 6 as appropriate). In this initialization process, the key sharing manager device 1 performs the following steps S1 to S5.

[0075] In step S1, the initialization means 10 acquires its own ID (ID0) from the authentication and distribution server 3. In step S2, the initialization means 10 initializes the state variable γ and stores it in the storage means 13. Here, the initialization means 10 sets the identifier ID0 acquired in step S1 to the state variable γ and initializes the RT of the state variable γ. In step S3, the signature verification key generation means 11 generates a private key for the electronic signature (signature key sk sig ) and the public key for verification (verification key vk sig ) and generate. In step S4, the signature verification key generation means 11 generates the verification key vk generated in step S3. sig is sent to the authentication and distribution server 3. This results in the verification key vk sig is registered in the authentication and delivery server 3. In step S5, the signature verification key generation means 11 generates the signature key sk generated in step S3. sig is stored in the storage means 13.

[0076] On the other hand, the key sharing member device 2 performs the following steps S6 to S9. In step S6, the initialization means 20 receives its own ID (ID i ) to get the In step S7, the initialization means 20 initializes the state variable γ and stores it in the storage means 22. Here, the initialization means 20 initializes the identifier ID acquired in step S6. i is set to the state variable γ, and RT of the state variable γ is initialized. In step S8, the verification key acquisition means 21 acquires the verification key vk generated by the key sharing manager device 1 and registered in the authentication and distribution server 3 in step S4. sig Get. In step S9, the verification key acquisition means 21 acquires the verification key vk acquired in step S8. sig is stored in the storage means 22. Through the above operations, the key sharing manager device 1 and the key sharing member devices 2 are each initialized.

[0077] (Group generation) Next, the group generation process of the key sharing system 100 will be described with reference to FIG. 9 (for the configuration, refer to FIGS. 2, 4, and 6 as appropriate). It is assumed that the authentication and distribution server 3 has collected in advance the identifiers IDs of users (key sharing member devices 2) who wish to join the group.

[0078] First, in step S10, the key sharing manager device 1 obtains the identifiers ID (group G = (ID1, ID2, ...)) of the members (key sharing member devices 2, 2, ...) who wish to join the group from the authentication / distribution server 3 using the group generation means 150 of the message generation means 15.

[0079] In step S11, the group generation means 150 generates a public key pk and a private key sk of the public key cryptography system using the encryption key generation means 12 for its own identifier ID0 and for each of the identifiers ID of the key sharing member devices 2, 2, ... obtained in step S10 (group G = (ID1, ID2, ...)), and stores them in the storage means 13. In step S12, the group generation means 150 sets its own identifier ID0, public key pk0, and secret key sk0 to the leaf node of RT, and also sets the member's identifier ID i and the public key pk i Set the following. In step S13, the group generating means 150 stores the RT generated in step S12 in the state variable γ of the storage means 13.

[0080] In step S14, the group generation means 150 generates a group generation message T cre Generate. In step S15, the signature adding means 16 adds the group creation message T cre Generate a signature (digital signature) σ for In step S16, the signature adding means 16 adds the group generation message T cre and sends the signed group creation message (T cre , σ) to the key sharing member devices 2, 2, . . .

[0081] Then, in step S17, the key sharing member device 2 receives the signed group creation message (T cre ,σ). In step S18, the signature verification means 25 uses the verification key vk stored in the storage means 22. sig Using the signed group creation message (T cre , σ) is the signature of the key sharing manager device 1. In step S19, the signature verification means 25 determines whether or not the message can be accepted based on the verification result of the signature σ in step S18.

[0082] If it is determined that the message cannot be accepted (No in step S19), the signature verification means 25 cre (not shown as a step). On the other hand, if it is determined that the message can be accepted (Yes in step S19), in step S20, the message processing means 26 sends the group generation message T cre The key sharing manager 1 requests (secret key request) the private key sk that pairs with the public key pk that corresponds to its own identifier ID included in the public key pk.

[0083] Then, in step S21, the key sharing manager device 1 receives the private key request sent in step S20 by the encryption key distribution means 14. In step S22, the encryption key distribution means 14 reads out from the storage means 13 the private key sk corresponding to the identifier ID of the key sharing member device 2 that has requested the private key, and transmits it to the key sharing member device 2 with the identifier ID. Then, in step S23, the key sharing member device 2 receives the private key sk transmitted in step S22 by the encryption key acquisition means 24.

[0084] In step S24, the message processing means 26 receives the group generation message T cre The identifier ID and public key pk of the group included in are set as leaf nodes of RT. In step S25, the message processing means 26 sets the secret key sk received in step S23 to the leaf node of RT corresponding to its own identifier ID. In step S26, the message processing means 26 stores the RT set in steps S24 and S25 in the state variable γ of the storage means 22. Through the above operations, the key information is shared within the group.

[0085] (Member added) Next, the member addition process of the key sharing system 100 will be described with reference to FIGS. 10A to 10E (for the configuration, refer to FIGS. 2, 4, and 6 as appropriate).

[0086] In this member addition process, the operation differs depending on whether the person who adds the member is the key sharing manager device 1 or the key sharing member device 2. First, we will explain the operation when the person who added the member is the key sharing manager device 1. Fig. 10A shows the operation of the key sharing manager device 1 and the key sharing member device 2 of the added member. Fig. 10B shows the operation of the key sharing manager device 1 and the key sharing member device 2 other than the added member.

[0087] First, with reference to FIG. 10A, the operations of the key sharing manager device 1 that added the member and the key sharing member device 2 that added the member will be described. In step S30, the key sharing manager device 1 obtains the identifier ID' of the additional member (key sharing member device 2) who wishes to join the group from the authentication / distribution server 3 or via an input means (not shown) using the member addition means 151 of the message generation means 15.

[0088] In step S31, the member adding means 151 causes the encryption key generating means 12 to generate a secret key sk′ and a public key pk′ corresponding to the identifier ID′ acquired in step S30, and stores them in the storage means 13. In step S32, the member addition means 151 sets an identifier ID' and a public key pk' to an empty leaf node of RT to which no member has yet been set. In step S33, the member addition means 151 stores the RT updated in step S32 in the state variable γ of the storage means 13.

[0089] In step S34, the member addition means 151 sends a member addition message T add Generate. In step S35, the signature adding means 16 adds the member addition message T add Generate a signature (digital signature) σ for In step S36, the signature adding means 16 adds the member addition message T add and sends the signed member addition message (T add , σ) to the key sharing member device 2 corresponding to the added identifier ID′.

[0090] Then, in step S37, the key sharing member device 2 that will become an additional member of the group receives the signed member addition message (T add,σ). In step S38, the signature verification means 25 uses the verification key vk stored in the storage means 22. sig Using the signed member addition message (T add , σ) is the signature of the key sharing manager device 1. In step S39, the signature verification means 25 determines whether or not the message can be accepted based on the verification result of the signature σ in step S38.

[0091] If it is determined that the message cannot be accepted (No in step S39), the signature verification means 25 add (not shown as a step). On the other hand, if it is determined that the message can be accepted (Yes in step S39), in step S40, the message processing means 26 sends the member addition message T add The user requests (secret key request) from the key sharing manager 1 for a private key sk' that pairs with the public key pk' corresponding to the user's own identifier ID included in the request.

[0092] Then, in step S41, the key sharing manager device 1 receives the private key request sent in step S40 by the encryption key distribution means 14. In step S42, the encryption key distribution means 14 reads out from the storage means 13 the private key sk' corresponding to the identifier ID' of the key sharing member device 2 that requested the private key, and transmits it to the key sharing member device 2 with the identifier ID'. Then, in step S43, the key sharing member device 2 receives the private key sk' transmitted in step S42 by the encryption key acquisition means 24.

[0093] In step S44, the message processing means 26 sets an identifier ID', a public key pk', and a secret key sk' to an empty leaf node of RT to which no member has yet been set. In step S45, the message processing means 26 stores the RT set in step S44 in the state variable γ of the storage means 22. As a result, the key information is distributed to the key sharing member devices 2 of the newly added members.

[0094] Next, with reference to FIG. 10B, the operation of the key sharing manager device 1 that added the member and the key sharing member device 2 other than the added member will be described. The operations of the key sharing member device 1 in steps S30 to S36 in FIG. 10B are the same as those described in FIG. 10A. Furthermore, the operations of the key sharing member device 2 in steps S37 to S39 in FIG. 10B are the same as those described in FIG. 10A.

[0095] If it is determined in step S39 that the message can be accepted (Yes in step S39), in step S44B, the message processing means 26 sends a member addition message T add The identifier ID′ and public key pk′ included in the In step S45, the message processing means 26 stores the RT set in step S44B in the state variable γ of the storage means 22. As a result, the key information of the newly added member is set in the key sharing member device 2 that was already a member.

[0096] Next, with reference to Figs. 10C to 10E, the operation when the person who added the member is the key sharing member device 2 will be described. Note that Fig. 10C shows the operation when the key sharing member device 2 who added the member sends a member addition message T add 10D shows the operation up to the point where the key sharing member device 2, which is an additional member, sends the member addition message T add 10E shows the operation after the key sharing manager device 1 and the key sharing member device 2 other than the added member receive the member addition message T add This shows the operation after receiving

[0097] First, referring to FIG. 10C, the key sharing member device 2 that is the member addition executor sends a member addition message T addThe operation up to distribution will be explained. In step S50, the key sharing member device 2, which is the device that adds the member, obtains the identifier ID' of the additional member (key sharing member device 2) who wishes to join the group from the authentication / distribution server 3 or via an input means (not shown) using the member addition means 231 of the message generation means 23. In step S51, the message processing means 26 requests (public key request) the public key pk' corresponding to the identifier ID' acquired in step S50 from the key sharing manager 1.

[0098] Then, in step S52, the key sharing manager device 1 receives the public key request sent in step S51 by the encryption key distribution means 14. In step S53, the encryption key distribution means 14 causes the encryption key generation means 12 to generate a private key sk′ and a public key pk′ corresponding to the identifier ID′ of the key sharing member device 2 that requested the public key, and stores them in the storage means 13. In step S54, the encryption key distribution means 14 transmits the public key pk' corresponding to the identifier ID' of the key sharing member device 2 that requested the public key to the key sharing member device 2 with the identifier ID'.

[0099] Then, in step S55, the key sharing member device 2 receives the public key pk' transmitted in step S54 by means of the encryption key acquisition means 24. In step S56, the member addition means 231 sets the identifier ID' and the public key pk' to an empty leaf node of RT to which no member has yet been set. In step S57, the member addition means 231 stores the RT updated in step S56 in the state variable γ of the storage means 22.

[0100] In step S58, the member addition means 231 sends a member addition message T add Generate. In step S59, the member addition means 231 sends the member addition message T generated in step S58 to the authentication and distribution server 3. add The key sharing manager device 1 issues an instruction to distribute the key to the key sharing member devices 2 that are the added members, and the key sharing member devices 2 that are not the added members.

[0101] Next, referring to FIG. 10D, a member addition message T add The operation of the key sharing member device 2, which is an added member, after receiving the message will be described.

[0102] In step S60, the key sharing member device 2 that is the new member receives the member addition message T add Here, the key sharing member device 2 receives a member addition message T add If the signature verification means 25 obtains the signature, the message is not verified, and the message processing means 26 processes the message as is. The operations in the following steps S61 to S66 are the same as the operations in steps S40 to S45 described with reference to FIG. 10A.

[0103] Next, referring to FIG. 10E, a member addition message T add The operation of the key sharing manager 1 after receiving the message will be described below. In step S60, the key sharing manager device 1 receives the member addition message T add Get. In step S65, the message processing means 17 sets the identifier ID' and the public key pk' to an empty leaf node of RT to which no member has yet been set. In step S66, the message processing means 17 stores the RT updated in step S65 in the state variable γ of the storage means 13.

[0104] In addition, the member addition message T add The operations of the key sharing member devices 2 other than the added member after receiving the message are the same as those of the key sharing manager device 1.

[0105] That is, in step S60, the key sharing member device 2 receives the member addition message T add Get. In step S65, the message processing means 26 sets the identifier ID' and the public key pk' to an empty leaf node of RT to which no member has yet been set. In step S66, the message processing means 26 stores the RT updated in step S65 in the state variable γ of the storage means 22. As a result, the key information of the key sharing member device 2 of the newly added member is distributed to the key sharing manager device 1 and the key sharing member devices 2 other than the added member.

[0106] (Delete member) Next, the member deletion process of the key sharing system 100 will be described with reference to FIG. 11 (for the configuration, refer to FIGS. 2, 4, and 6 as appropriate).

[0107] In this member deletion process, the key sharing manager device 1 performs the following steps S70 to S75. In step S70, the member deletion means 152 of the message generation means 15 obtains the identifier (deletion ID') of the member (key sharing member device 2) to be deleted from the group from the authentication / distribution server 3 or via an input means (not shown). In step S71, the member deletion means 152 deletes the deletion ID' by setting the leaf node corresponding to the deletion ID' of the RT to a free leaf node. In step S72, the member deleting means 152 stores the RT updated in step S71 in the state variable γ of the storage means 13.

[0108] In step S73, the member deletion means 152 sends a member deletion message T rem Generate. In step S74, the signature adding means 16 adds the member deletion message T rem Generate a signature (digital signature) σ for In step S75, the signature adding means 16 adds the member deletion message T rem and sends the signed member deletion message (T rem , σ) to the key sharing member devices 2, 2, . . .

[0109] Then, the key sharing member device 2 performs the following processes of steps S76 to S80. In step S76, the signature verification means 25 receives the signed member deletion message (T rem ,σ). In step S77, the signature verification means 25 uses the verification key vk stored in the storage means 22 sig , and then send the signed member deletion message (T rem , σ) is the signature of the key sharing manager device 1. In step S78, the signature verification means 25 determines whether or not the message can be accepted based on the verification result of the signature σ in step S77.

[0110] If it is determined that the message cannot be accepted (No in step S78), the signature verification means 25 rem (not shown as a step). On the other hand, if it is determined that the message can be accepted (Yes in step S78), in step S79, the message processing means 26 sends the member deletion message T rem The identifier ID' is deleted by setting the leaf node of RT corresponding to the identifier (deletion ID') included in the list to a free leaf node. In step S80, the message processing means 26 stores the RT set in step S79 in the state variable γ of the storage means 22. Through the above operations, the key information of the key sharing member device 2 that has been deleted from the group members is deleted.

[0111] (Status update) Next, the state update process of the key sharing system 100 will be described with reference to FIGS. 12A and 12B (for the configuration, see FIGS. 2, 4, and 6 as appropriate).

[0112] In this state update process, the operation differs depending on whether the update executor, who is the entity that updates the state, is the key sharing manager device 1 or the key sharing member device 2. First, with reference to FIG. 12A, the operation when the state update executor is the key sharing manager device 1 will be described. In this state update process, the key sharing manager device 1 performs the following steps S90 to S95.

[0113] In step S90, when the state update means 153 of the message generation means 15 is instructed to update the state variables via an input means (not shown), it generates a new public key pk0 and private key sk0 of the public key cryptography corresponding to the identifier ID0. In step S91, the state update means 153 sets its own identifier ID0, public key pk0, and secret key sk0 to the leaf node of RT. In step S92, the state update means 153 stores the RT set in step S91 in the state variable γ of the storage means 13.

[0114] In step S93, the state update means 153 sends a state update message T upd Generate. In step S94, the signature adding means 16 adds the status update message T upd Generate a signature (digital signature) σ for In step S95, the signature adding means 16 adds the status update message T upd and sends the signed status update message (T upd , σ) to the key sharing member devices 2, 2, . . .

[0115] Then, the key sharing member device 2 performs the following processes of steps S96 to S100. In step S96, the signature verification means 25 receives the signed status update message (T upd ,σ). In step S97, the signature verification means 25 uses the verification key vk stored in the storage means 22. sig , and the signed state update message (T upd , σ) is the signature of the key sharing manager device 1. In step S98, the signature verification means 25 determines whether or not the message can be accepted based on the verification result of the signature σ in step S97.

[0116] If it is determined that the message cannot be accepted (No in step S98), the signature verification means 25 upd (not shown as a step). On the other hand, if it is determined that the message can be received (Yes in step S98), in step S99, the message processing means 26 sends the status update message T upd From the identifier ID0 and public key pk0 included in the RT, a new public key pk0 is set in the leaf node corresponding to the identifier ID0 of the RT. In step S100, the message processing means 26 stores the RT set in step S99 in the state variable γ of the storage means 22. When the state of the key sharing manager device 1 is updated by the above operation, the key information is reflected in the key sharing member devices 2 that are members of the group.

[0117] Next, with reference to FIG. 12B, the operation when the state update executor is the key sharing member device 2 will be described. In step S110, when the key sharing member device 2, which is the state updater, is instructed to update the state variables by the state update means 233 of the message generation means 23 via an input means (not shown), it requests (key update request) the key sharing manager device 1 to update the key corresponding to its own identifier ID.

[0118] Then, in step S111, the key sharing manager device 1 receives the key update request sent in step S110 by the encryption key distribution means 14. In step S112, the encryption key distribution means 14 causes the encryption key generation means 12 to generate a private key sk and a public key pk corresponding to the identifier ID of the key sharing member device 2 that has requested the key update, and stores them in the storage means 13. In step S113, the encryption key distribution means 14 transmits the private key sk and public key pk corresponding to the identifier ID of the key sharing member device 2 that has requested the key update to the key sharing member device 2 with the identifier ID.

[0119] Then, in step S114, the key sharing member device 2 receives, by means of the encryption key acquisition means 24, the private key sk and the public key pk transmitted in step S113. In step S115, the state update means 233 of the message generation means 23 sets the public key pk and secret key sk received in step S114 in the leaf node corresponding to the RT's own identifier ID. In step S116, the state update means 233 stores the RT set in step S115 in the state variable γ of the storage means 22.

[0120] In step S117, the state update means 233 sends a state update message T upd Generate. In step S118, the status update means 233 transmits the status update message T generated in step S117 to the authentication and distribution server 3. updThe key sharing manager 1 and the key sharing member devices 2 other than the update executor are instructed to distribute the key sharing information.

[0121] Then, in step S119, the key sharing manager device 1 receives the status update message T upd Get. In step S120, the message processing means 17 receives the status update message T upd From the identifier ID and public key pk included in the RT, a new public key pk is set in the leaf node corresponding to the identifier ID of the RT. In step S121, the message processing means 17 stores the RT set in step S120 in the state variable γ of the storage means 13. In addition, the key sharing member device 2 of the update executor sends a status update message T upd The operation of the key sharing member device 2 other than the update executor that acquires the key is the same as the operation of the key sharing manager device 1.

[0122] That is, in step S119, the key sharing member device 2 receives the status update message T upd Get. In step S120, the message processing means 26 receives the status update message T upd From the identifier ID and public key pk included in the RT, a new public key pk is set in the leaf node corresponding to the identifier ID of the RT. In step S121, the message processing means 26 stores the RT updated in step S120 in the state variable γ of the storage means 22. When the state of a key sharing member device 2 is updated by the above operation, the key information is reflected in the key sharing manager device 1 that is a member of the group and in key sharing member devices 2 other than the update executor.

[0123] Although the embodiment of the present invention has been described above, the present invention is not limited to this embodiment. [Modification] For example, here, the message generation means 15 (FIGS. 2 and 4) of the key sharing manager device 1 is configured to include group generation means 150, member addition means 151, member deletion means 152, and status update means 153. However, if the groups are fixed, such as if there are no changes to the groups initially generated, the message generation means 15 may include at least group generation means 150, and the other components may be any configuration.

[0124] Also, here, the message generation means 23 (FIGS. 6 and 7) of the key sharing member device 2 is configured to include member addition means 231 and status update means 233. However, the key sharing member device 2 may change its authority depending on the application, and may be provided with any of the group generation means 230, member addition means 231, member deletion means 232, and status update means 233 depending on the authority. [Explanation of symbols]

[0125] 100 Key Sharing System 1. Key sharing manager device 10 Initialization means 11 Signature verification key generation method 12 Encryption key generation means 13 Memory means 14 Encryption key distribution method 15 Message Generation Methods 150 Group Generation Methods 151 Member Addition Method 152 Member deletion method 153 State Update Method 16 Signature addition means 17 Message Processing Methods 2. Key sharing member devices 20 Initialization means 21 Verification key acquisition method 22 Memory means 23 Message Generation Method 24 Encryption key acquisition means 25 Signature Verification Methods 26 Message Processing Methods 3 Authentication and delivery server

Claims

1. A key sharing system is configured with one key sharing manager device that serves as a manager of a group for sharing a key used for encrypting data, and a plurality of key sharing member devices that serve as members of the group, the key sharing manager device comprising: a signature verification key generation means for generating a signature key and a verification key for an electronic signature; an encryption key generating means for generating a private key and a public key of a public key cryptosystem in association with identifiers of the manager and the member; an encryption key distribution means for distributing the private key of the member in response to a request from a member having a matching identifier; a group generation means for setting the private keys and public keys of the manager and the members generated by the encryption key generation means in state variables, and for generating a message for notifying all members of the public keys of the manager and the members among the state variables; a signature adding means for generating a signature for the message using the signature key, adding the signature to the message, and transmitting the signed message to all of the members; A key sharing manager device comprising:

2. 2. The key sharing manager device according to claim 1, further comprising a member adding means for generating a private key and an encryption key for the member to be added by the encryption key generating means when the member is added, and setting the private key and encryption key for the member to be added to the state variable, and for generating a message to notify all members of the added public key.

3. 3. The key sharing manager device according to claim 1, further comprising a member deletion means for deleting the public key of the member to be deleted from the state variable when the member is deleted, and generating a message to notify all members of the deleted public key.

4. A key sharing manager device as described in any one of claims 1 to 3, characterized in that when updating the manager's key information, the key sharing manager further comprises a state update means for generating a new private key and public key for the manager using the encryption key generation means, setting them in the state variables, and generating a message to notify all members of the generated public key.

5. A key sharing manager program for causing a computer to function as the key sharing manager device according to claim 1 or 4.

Images