Key sharing manager device and its program

Abstract

To provide a key sharing manager device capable of managing a group by assigning specific authority to a manager of the group sharing a key.SOLUTION: A key sharing manager device 1 includes: signature verification key generation means 11 for generating a signature key and a verification key for electronic signature; group generation means 130 for generating a manager's private key and public key, acquiring a member's public key from a key generation server 3, setting them in state variables storing key information, and generating a message for notifying all members of the manager's public key and the member's public key among the state variables; and signature addition means 14 for generating a signature for the message using the signature key, adding it to the message, and transmitting the message with the signature to all the members.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to a key sharing manager device and Bisono Regarding the program. [Background technology]

[0002] In recent years, video conferencing applications such as Zoom (registered trademark) and messenger applications such as LINE (registered trademark) have become widely used both in Japan and overseas. However, for example, the Ministry of Internal Affairs and Communications' Information and Communications White Paper for 2020 pointed out vulnerabilities in video conferencing applications, making security assurance a critical issue. Zoom and LINE use end-to-end (E2E) encryption to ensure security between users' devices. The technology for sending and receiving messages safely using E2E encryption is called secure messaging. There are various E2E encryption methods, a typical example being the Signal protocol (Non-Patent Document 1). Zoom and LINE each use their own unique E2E encryption technology (Non-Patent Documents 2 and 3).

[0003] E2E encryption can be broadly divided into two steps. One is for users to share a public key (key agreement). The other is for messages to be encrypted using a private key corresponding to the shared public key. The Internet Engineering Task Force (IETF), an Internet standards organization, is working on standardization of secure messaging and is promoting the standardization of Continuous Key Agreement (CKA) technology, which has higher security and efficiency (Non-Patent Document 4). CKA technology is one of the key agreement technologies, and is characterized by its ability to enable long-term communication sessions and the ability for users to share private keys asynchronously. However, the CKA technique only allows keys to be shared among a set of users, and does not allow keys to be shared among a group. Therefore, in 2020, Alwen et al. proposed a Continuous Group Key Agreement (CGKA) technology in which multiple users share a common key (Non-Patent Document 5). [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] M. Marlinspike and T. Perrin, "The Double Ratchet Algorithm", https: / / whispersystems.org / docs / specifications / doubleratchet / doubleratchet.pdf, November 20, 2016. [Non-patent document 2] J. Blum, S. Booth, O. Gal, M. Krohn, J. Len, K. Lyons, A. Marcedone, M. Maxim, M. Ember Mou, J. O'Connor, S. Rien, M. Steele, M. Green, L Kissner, and A. Stamos, "https: / / github.com / zoom / zoom-e2e-whitepaper / blob / master / archive / zoom_e2e_v3.pdf", Zoom Video Communications, Inc., December 15, 2020 [Non-patent document 3] "LINE Encryption Overview Technical Whitepaper." https: / / scdn.line-apps.com / stf / linecorp / en / csr / line-encryption-whitepaper-ver2.0.pdf, LINE Corporation, October 28, 2019 [Non-patent document 4] Alwen, J., Coretti, S., & Dodis, Y. (2019, May). "The double ratchet: security notions, proofs, and modularization for the signal protocol." In Annual International Conference on the Theory and Applications of Cryptographic Techniques (pp. 129-158). Springer, Cham. [Non-patent document 5] Alwen, J., Coretti, S., Dodis, Y., & Tselekounis, Y. (2020, August). "Security analysis and improvements for the IETF MLS standard for group messaging." In Annual International Cryptology Conference (pp. 248-277). Springer, Cham. Summary of the Invention [Problem to be solved by the invention]

[0005] Conventional E2E encryption methods, such as LINE's Letter Sealing feature that encrypts and sends messages, make it easy to add or remove users, but they are inefficient because the shared key must be recreated from scratch every time a user is added or removed. On the other hand, CGKA is a technology that allows multiple users to share a private key, and it does not require users to recreate a shared key from scratch like LINE, and it allows for flexible changes to the member composition. However, like the E2E encryption method, CGKA basically treats multiple users as equals, and anyone can add or delete other users, which poses a risk of impersonation.

[0006] The present invention has been made in view of the above-mentioned problems, and provides a key sharing manager device and a key sharing system that can manage a group by assigning one user (one terminal device) as a group manager in a group that shares a key and granting authority that other users (other terminal devices) do not have. Bisono The objective is to provide a program. [Means for solving the problem]

[0007] In order to solve the above problem, the key sharing manager device of the present invention is a key sharing manager device in a key sharing system consisting of one key sharing manager device that serves as a manager of a group for sharing keys used to encrypt data, and multiple key sharing member devices that serve as members of the group, and is configured to include a signature verification key generation means, a group generation means, and a signature addition means.

[0008] In this configuration, the key sharing manager generates a signature key and a verification key for use in an electronic signature by means of the signature verification key generating means. The key sharing manager device then uses its group generation means to generate a private key and a public key for the manager, obtains the public keys of the members from a key generation server of a third-party organization, and sets them in a state variable that stores key information. This allows the key sharing manager device to share the public key of the entire group in the state variable. Furthermore, the key sharing manager device uses its group generation means to generate a message that notifies all members of the manager's public key and the members' public keys.

[0009] The key sharing manager device then uses the signature key to generate a signature for the message generated by the group generation device, attaches the signature to the message, and transmits the signed message to all members. This message enables the key sharing member devices to share the public key of the entire group. Furthermore, since the message is signed, the key sharing manager device is authorized to create a group.

[0010] The key sharing manager may also authorize a message to add a member, a message to delete a member, or a message to update a state variable by attaching a signature to these messages. The key sharing manager device can be operated by a key sharing manager program that causes a computer to function as each of the above-mentioned means. [Effects of the Invention]

[0015] The present invention provides the following excellent effects. According to the present invention, it is possible to provide authority using a digital signature to a specific user (manager) while realizing the conventional flexible key sharing. This allows the present invention to realize one-to-many group secure messaging. [Brief explanation of the drawings]

[0016] [Figure 1] 1 is a system configuration diagram showing the overall configuration of a key sharing system including a key sharing manager device and key sharing member devices according to an embodiment of the present invention. [Figure 2] 1 is a block diagram showing a configuration of a key sharing manager device according to an embodiment of the present invention; [Figure 3] FIG. 10 is an explanatory diagram for explaining the structure of a ratchet tree, which is a state variable. [Figure 4] 2 is a block diagram showing the internal configuration of a message generating means in FIG. 1. FIG. [Figure 5] FIG. 10 is an explanatory diagram illustrating the correspondence between a ratchet tree and an identifier, a public key, and a private key. [Figure 6] 1 is a block diagram showing a configuration of a key sharing member device according to an embodiment of the present invention. [Figure 7] FIG. 7 is a block diagram showing the internal configuration of a message generating means in FIG. 6. [Figure 8] 10 is a flowchart illustrating an operation of an initialization process of the key sharing system according to the embodiment of the present invention. [Figure 9]10 is a flowchart illustrating an operation of a group generation process of the key sharing system according to the embodiment of the present invention. [Figure 10] 10 is a flowchart showing the operation of a key sharing manager in the member addition process of the key sharing system according to the embodiment of the present invention. [Figure 11] 10 is a flowchart showing the operation of a key sharing member device to be added, part of the operation of a member addition process of the key sharing system according to the embodiment of the present invention. [Figure 12] 10 is a flowchart showing the operation of a key sharing member device other than the key sharing member device to be added, in the member addition process of the key sharing system according to the embodiment of the present invention. [Figure 13] 10 is a flowchart showing the operation of a member deletion process of the key sharing system according to the embodiment of the present invention. [Figure 14] 10 is a flowchart illustrating an operation of a state update process of the key sharing system according to the embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0017] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. [Configuration of key sharing system] First, the configuration of a key sharing system 100 will be described with reference to FIG. The key sharing system 100 shares a key used to encrypt data among the terminal devices that make up a group, and manages the group by granting one terminal device that serves as the group manager authority that is not available to the other terminal devices that are group members. The keys used for encryption are encryption keys (private keys) and decryption keys (public keys) for data when various data such as video distribution and music distribution is performed within a group set in advance on the network N. That is, the key sharing system 100 is an application that functions on a system that distributes data. Here, a description of data distribution will be omitted and the key sharing system will be described in detail.

[0018] The key sharing system 100 comprises a key sharing manager device 1, a key sharing member device 2, a key generation server 3, and an authentication and distribution server 4, which are connected via a network N. One key sharing manager device 1 and multiple key sharing member devices 2, 2, ... form one group. The key generation server 3 and the authentication and distribution server 4 are not limited to this group, but are servers that can also function for other groups. The key sharing manager device 1 and the key sharing member devices 2 download application software for data distribution from a server (not shown) and execute the software to implement their respective functions.

[0019] The key sharing manager device 1 is a terminal device that forms a group together with multiple key sharing member devices 2, 2, ..., shares an encryption key, and also serves as the manager (administrator) of the group. The key sharing manager device 1 sends and receives control messages (hereinafter simply referred to as messages) to and from the key sharing member devices 2 to create groups, add and delete members, and update the group status.

[0020] For example, the key sharing manager device 1 is a terminal device managed by a broadcasting company that broadcasts programs, a distribution company that distributes video and audio, etc. When remotely distributing programs, etc., the key sharing manager device 1 forms a group of pre-registered key sharing member devices 2, 2, ... and shares a key. Although one key sharing manager device 1 is shown here, there may be a plurality of key sharing manager devices 1 according to the number of groups formed in the key sharing system 100. The configuration of this key sharing manager device 1 will be described later.

[0021] The key sharing member devices 2 are terminal devices that become members of a group that shares encryption keys under the management of the key sharing manager device 1. For example, the key sharing member devices 2 are terminals that view programs distributed by broadcasting companies or distribution companies. Sharing an encryption key means that the entire group shares a public key corresponding to a private key secretly held by each member. Here, the key sharing member devices 2, 2, ... are illustrated as belonging to the same group, but there are also multiple key sharing member devices 2 that belong to different groups and multiple key sharing member devices 2 that belong to different groups in the key sharing system 100. The configuration of these key sharing member devices 2 will be described later.

[0022] The key generation server 3 is a public key infrastructure (PKI) that distributes public keys for public key cryptography provided by a trusted third party. The key generation server 3 has the function of generating a public key (decryption key) pk and a private key (encryption key) sk corresponding to the identifier (ID) of a terminal device (key sharing member device 2) and recording them in association with the ID. At this time, when a terminal device with an identifier ID requests a public key pk' corresponding to another identifier ID', the key generation server 3 notifies the public key pk'. Also, when a terminal device with an identifier ID requests a private key sk corresponding to its own identifier ID, the key generation server 3 notifies the private key sk.

[0023] The authentication and distribution server 4 is a server that distributes identifiers (IDs) and delivers key information to terminal devices (key sharing manager device 1, key sharing member devices 2) on the network N that run data distribution applications such as video distribution and music distribution. Here, the authentication and distribution server 4 assigns IDs to users participating in the application by authenticating their phone numbers, etc. The authentication and distribution server 4 also relays messages related to key sharing between the terminal devices (key sharing manager device 1, key sharing member devices 2).

[0024] Furthermore, here, the authentication and distribution server 4 further has a function of collecting IDs of users who wish to join a group when the group is formed in an application, and notifying the key sharing manager device 1, which is the manager of the pre-set group. Note that this collection of IDs does not necessarily have to be performed by the authentication and distribution server 4, but may be performed between terminal devices (key sharing manager device 1, key sharing member devices 2).

[0025] Also, here, the authentication and distribution server 4 distributes a verification key for the electronic signature generated by the key sharing manager device 1 to the key sharing member devices 2, 2, . . . The configurations of the key sharing manager device 1 and the key sharing member devices 2 that make up the key sharing system 100 will be described below.

[0026] [Configuration of the key sharing manager device] First, the configuration of the key sharing manager device 1 will be described with reference to FIG. The key sharing manager device 1 includes an initialization means 10, a signature verification key generation means 11, a storage means 12, a message generation means 13 (including a group generation means 130 (Figure 4) etc.), a signature addition means 14, and a message processing means 15.

[0027] The initialization means 10 initializes state variables that hold key information shared by the key sharing manager device 1 (manager) and the key sharing member devices 2 (members). The initialization means 10 acquires its own ID (here, ID0 of the manager) from the authentication and distribution server 4 and performs initialization processing. This initialization processing is a process of inputting the user's ID (ID0) and outputting the state variable γ according to the initialization algorithm (γ←init(ID)) of the CGKA protocol.

[0028] The state variable γ is a variable that records at least the group's own identifier ID, and the identifiers IDs and key pairs (public key, private key) of the members that make up the group. Note that the private keys stored in the state variable γ are only those corresponding to the group's own identifier ID, and the private keys of other members are not stored. The ID and key pair in this state variable γ are recorded in a tree structure of a ratchet tree (RT).

[0029] The structure of the RT will now be described with reference to Fig. 3. The RT is a left-balanced binary tree (LBBT) in which the child node on the left side of the root node R has a complete binary tree structure. For example, the child node C1 on the left side of the root node R and below form a complete binary tree structure. Also, the child node C2 on the right side of the root node R and below form an LBBT, and the child node C3 on the left side of C2 and below form a complete binary tree structure. Here, the total number of nodes in RT (including the root node) is set to n, and the total number of the root node R and the nodes of the complete binary tree on the left side of the root node R is set to x. n nodes with LBBT (LBBT n ) is configured, and LBBT (LBBT n-x ) is constructed, where x is the largest power of 2 among the divisors of n. In the CGKA protocol, an ID and a key pair (public key, private key) are associated with each leaf node of an RT. Returning to FIG. 2, the configuration of the key sharing manager device 1 will be explained further.

[0030] The initialization means 10 sets its own ID0 to the state variable γ and initializes the RT. The initialization means 10 stores the initialized state variable γ in the storage means 12. The initialization means 10 also notifies the signature verification key generation means 11 of the completion of the initialization.

[0031] The signature verification key generation means 11 generates a private key for electronic signature (signature key sk sig ) and the public key for verification (verification key vk sig ) and generate After initialization by the initialization means 10, the signature verification key generation means 11 generates a signature key and a verification key from security parameters having a preset key length. Note that the method for generating the signature key and the verification key is a general digital signature technique, and therefore a description thereof will be omitted. The signature verification key generation means 11 generates the signature key sk sig is stored in the storage means 12, and the generated verification key vk sigis sent to the authentication and distribution server 4. This results in the verification key vk sig is registered in the authentication and distribution server 4 and distributed to the key sharing member devices 2, 2, . . .

[0032] The storage means 12 stores the state variable γ and the signature key sk sig The storage means 12 can be configured with a general storage device such as a semiconductor memory. The state variable γ stored in the storage means 12 is initialized by the initialization means 10 and updated by the message generation means 13 and the message processing means 15 . Also, the signature key sk stored in the storage means 12 sig is generated by the signature verification key generation means 11 and is referred to by the signature addition means 14.

[0033] The message generating means 13 generates a message (control message) of the CGKA protocol to be transmitted to the key sharing member device 2 that is a member of the group that shares the key.

[0034] Here, the internal configuration of the message generating means 13 will be described with reference to FIG. 4 (and also with reference to FIG. 2 as appropriate). The message generating means 13 includes a group generating means 130 , a member adding means 131 , a member deleting means 132 , and a status updating means 133 .

[0035] The group generation means 130 generates the manager's private key and public key, obtains the member's public key from the key generation server 3, sets it as key information in the state variable γ, and generates a message notifying all members of the manager's public key and the member's public key. Here, the group generation means 130 generates a group in which members (key sharing member devices 2, 2, . . . ) who wish to participate in the group share key information. The group generation means 130 acquires the identifiers ID (group G=(ID1, ID2, ...)) of the members (key sharing member devices 2, 2, ...) who wish to join the group from the authentication and distribution server 4, and generates a group generation message. The generation process of this group generation message is carried out using the group generation algorithm ((γ′,T cre )←create(γ,G)) inputs the state variable γ stored in the storage means 12 and the group member identifiers G=(ID1, ID2, . . . ), updates the state variable γ to γ′, and sends the group creation message T cre This is the process of generating

[0036] Specifically, the group generation means 130 generates a public key pk0 and a secret key sk0 of a public key cryptosystem corresponding to its own identifier ID0. Furthermore, the group generation means 130 generates the group member identifiers G=(ID1, ID2, . . . ). i The public key pk corresponding to i (pk1, pk2, . . . ) are obtained from the key generation server 3. It should be noted that the key pairs of members other than the manager are generated in the key generation server 3.

[0037] As shown in FIG. 5, the group generating means 130 associates its own identifier ID0, public key pk0, and secret key sk0 with the 0th leaf node Ln0 of RT of the state variable γ. Furthermore, the group generation means 130 associates an identifier ID1 and a public key pk1 with the first leaf node Ln1 of RT. Thereafter, the group generation means 130 associates the identifier ID and public key pk of a group member with the leaf node Ln. Note that in FIG. 5, "⊥" indicates that a predetermined initial value is set. As a result, the group generation means 130 updates the state variable γ and generates a new state variable γ′. The group generation means 130 stores the new state variable γ′ in the storage means 12.

[0038] In addition, the group generation means 130 adds its own identifier ID0 to the group member identifiers G=(ID1, ID2, ...) to generate G'=(ID0, ID1, ID2, ...), and adds its own public key pk0 to the group member public keys pk=(pk1, pk2, ...) to generate pk'=(pk0, pk1, pk2, ...). The group generation means 130 generates a group generation message T containing the identifier G′ of the generated group member and the public key pk′ of the group member. cre Generate. The group generation means 130 generates a group generation message T cre is output to the signature adding means 14.

[0039] When a member is added to a group, the member addition means 131 obtains the public key of the member to be added from the key generation server 3, sets it in the state variable γ that stores the key information, and generates a message to notify all members of the added key information. The member addition means 131 acquires the identifier ID' of a new member (key sharing member device 2) who wishes to join the group, and generates a member addition message. The process of generating this member addition message is carried out in accordance with the member addition algorithm ((γ',T add )←add(γ, ID′)) inputs the state variable γ stored in the storage means 12 and the identifier ID′ of the member to be added, updates the state variable γ to γ′, and sends a member addition message T add This is the process of generating

[0040] Specifically, the member addition means 131 acquires an identifier ID' of a member (key sharing member device 2) who wishes to newly join the group from the authentication and distribution server 4 or via an input means (not shown). The member addition means 131 also acquires a public key pk' corresponding to the identifier ID' from the key generation server 3. Then, the member addition means 131 adds an empty leaf node (for example, the leaf node Ln in FIG. 5) to which a member has not yet been set in the RT of the state variable γ. XIf there is no free leaf node in RT, the member addition means 131 adds a leaf node to RT and associates the identifier ID' with the public key pk'. As a result, the member addition means 131 updates the state variable γ and generates a new state variable γ′. The member addition means 131 stores the new state variable γ′ in the storage means 12. The member addition means 131 also sends a member addition message T add Generate. The member addition means 131 sends a member addition message T add is output to the signature adding means 14.

[0041] When a specified member is deleted, the member deletion means 132 deletes the key information (public key) of the member to be deleted from the state variable γ, and generates a message to notify all members of the deleted key information. The member deletion means 132 acquires the identifier ID' of the member (key sharing member device 2) in the group that is designated for deletion, and generates a member deletion message. The member deletion message generation process is performed using the member deletion algorithm ((γ',T rem )←rem(γ, ID′)) inputs the state variable γ stored in the storage means 12 and the identifier ID′ (deletion ID) of the member to be deleted, updates the state variable γ to γ′, and sends a member deletion message T rem This is the process of generating

[0042] Specifically, the member deletion means 132 acquires the identifier ID' of the member (key sharing member device 2) to be deleted from the group from the authentication and distribution server 4 or via input means (not shown). Then, the member deleting means 132 sets the leaf node corresponding to the identifier ID' of the RT of the state variable γ as a free leaf node. As a result, the member deletion means 132 updates the state variable γ and generates a new state variable γ′. The member deletion means 132 stores the new state variable γ′ in the storage means 12. The member deletion means 132 also sends a member deletion message T rem Generate. The member deletion means 132 sends a member deletion message T rem is output to the signature adding means 14.

[0043] When updating key information, the state update means 133 generates a new private key and public key for the manager, sets them in the state variable γ, and also generates a message to notify all members of the generated public key. The state update means 133 generates a state update message when updating its own key information, that is, a key pair (public key, private key). The generation process of this state update message is carried out in accordance with the state update algorithm ((γ′,T upd )←upd(γ)) inputs the state variable γ stored in the storage means 12, updates the state variable γ to γ′, and sends a state update message T upd This is the process of generating

[0044] Specifically, when an instruction to update the state variables is given via an input means (not shown), the state update means 133 generates a new public key pk and secret key sk for the public key cryptosystem. The state update means 133 updates the public key pk and the private key sk of the leaf node corresponding to its own identifier ID in the RT of the state variable γ. As a result, the state update means 133 updates the state variable γ and generates a new state variable γ′. The state update means 133 stores the new state variable γ′ in the storage means 12. The state update means 133 also sends a state update message T upd Generate. The state update means 133 sends a state update message T upd is output to the signature adding means 14. Returning to Figure 2, we continue the explanation.

[0045] The signature adding means 14 adds the signature key sk sigThe signature for the message is generated and attached to the message using the above, and the signed message is sent to the member. Here, the signature adding means 14 adds the message T (group generating message T cre ,Member addition message T add ,Member deletion message T rem ,State update message T upd ) and add a signature (digital signature). The signature adding means 14 calculates a hash value for the message using a predetermined hash function, and adds the signature key sk stored in the storage means 12 to the message. sig The signature σ is generated by encrypting the

[0046] Then, the signature adding means 14 generates a signed message (T, σ) by adding the signature σ to the message T, and transmits it to the group members (key sharing member devices 2, 2, ...) via the authentication and distribution server 4. The group members can be identified by the identifiers associated with the leaf nodes of RT of the state variable γ. Therefore, the signature adding means 14 instructs the authentication and distribution server 4 to distribute the signed message (T, σ) to the key sharing member devices 2, 2, ..., specifying the identifiers ID of the group members. As a result, the signed message (T, σ) is delivered to the group members via the authentication and delivery server 4.

[0047] The message processing means 15 receives a CGKA protocol message (control message) from a key sharing member device 2 that is a member of a group that shares a key, and performs processing corresponding to the message. The processing corresponding to this message is to input the state variable γ stored in the storage means 12 and the message T according to the message processing algorithm ((γ',I)←proc(γ,T)) of the CGKA protocol, and update the state variable γ to γ'. It is assumed here that the key sharing member device 2 does not have the authority to create a group or delete a member. That is, the key sharing member device 2 sends a member addition message T add , state update message T upd Only the following shall be received:

[0048] Specifically, the message processing means 15 receives the member addition message T add When receiving a member addition message T add The public key pk' corresponding to the identifier ID' of the additional member included in the member ID is obtained from the key generation server 3. Then, the message processing means 15 selects an empty leaf node (for example, the leaf node Ln in FIG. 5) in which a member of the RT of the state variable γ has not yet been set. X If there is no free leaf node in RT, the message processing means 15 adds a leaf node to RT and associates the identifier ID' with the public key pk'. As a result, the message processing means 15 updates the state variable γ and generates a new state variable γ'.

[0049] The message processing means 15 also processes the status update message T upd When receiving a member addition message T add A new state variable γ′ is generated by setting a new public key pk to the leaf node corresponding to the identifier ID of the RT of the state variable γ from the identifier ID and public key pk included in the state variable γ. The message processing means 15 stores the new state variable γ′ in the storage means 12 .

[0050] With the configuration described above, the key sharing manager device 1 can share key information with the key sharing member devices 2, 2, ... that make up a group. Furthermore, by adding a signature to a message, the key sharing manager device 1 can be given authority to create a group, etc., thereby realizing one-to-many secure group messaging. The key sharing manager device 1 can be operated by a program (key sharing manager program) that causes a computer to function as each of the above-mentioned means.

[0051] [Configuration of key sharing member devices] Next, the configuration of the key sharing member device 2 will be described with reference to FIG. The key sharing member device 2 comprises an initialization means 20 , a verification key acquisition means 21 , a storage means 22 , a message generation means 23 , a signature verification means 24 , and a message processing means 25 .

[0052] The initialization means 20 initializes state variables that hold key information shared by the key sharing manager device 1 (manager) and the key sharing member devices 2 (members). The initialization means 20 acquires its own ID from the authentication and distribution server 4 and performs initialization processing. This initialization processing is a processing to input the user's ID and output the state variable γ according to the initialization algorithm (γ←init(ID)) of the CGKA protocol, and is the same processing as the initialization means 10 described in FIG. 2. The initialization means 20 stores the initialized state variable γ in the storage means 22 .

[0053] The verification key acquisition means 21 acquires a public key (verification key vk) for verifying the digital signature generated by the key sharing manager device 1. sig ) is obtained. The verification key acquisition means 21 acquires the verification key vk sig is stored in the storage means 22.

[0054] The storage means 22 stores the state variable γ and the verification key vk sig The storage means 22 can be configured with a general storage device such as a semiconductor memory. The state variable γ stored in the storage means 22 is initialized by the initialization means 20 and updated by the message generation means 23 and the message processing means 25 . Also, the verification key vk stored in the storage means 22 sigis stored by the verification key acquisition means 21 and is referred to by the signature verification means 24.

[0055] The message generating means 23 generates a message (control message) of the CGKA protocol to be sent to the key sharing manager device 1, which is the manager of the group that shares the key, and to other key sharing member devices 2 that are members of the group. The message generating means 23 instructs the authentication and distribution server 4 to distribute the generated message T to the group members (key sharing manager device 1, key sharing member devices 2, 2, . . . ) by specifying the identifiers ID of the group members.

[0056] Here, the internal configuration of the message generating means 23 will be described with reference to FIG. 7 (and also with reference to FIG. 6 as appropriate). The message generation means 23 comprises member addition means 231 and status update means 233. The group generation means 230 and member deletion means 232 in Fig. 7 are not necessary when a one-to-many secure group is formed with one key sharing manager device 1 and multiple key sharing member devices 2, 2, ..., with the key sharing manager device 1 as the manager, as shown in Fig. 1. However, when a key sharing member device 2 forms an equal group with multiple other key sharing member devices 2, the message generation means 23 may be configured to comprise the group generation means 230 and member deletion means 232.

[0057] Note that the group generation means 230, member addition means 231, member deletion means 232, and status update means 233 have the same functions as the group generation means 130, member addition means 131, member deletion means 132, and status update means 133 described in Figure 4, respectively, and therefore their explanation will be omitted. Returning to FIG. 6, the explanation continues.

[0058] The signature verification means 24 receives a signed message (T, σ) in which a signature σ is added to a message T from the key sharing manager device 1, which is the manager of the group that shares the key, and verifies the verification key vk sig The signature (electronic signature) is verified using the above. The signature verification means 24 calculates a hash value for the message T using the same hash function as the signature addition means 14 (FIG. 2). The signature verification means 24 also calculates the signature σ added to the message T using the verification key vk stored in the storage means 22. sig Decrypt with. The signature verification means 24 then verifies whether the signature σ is the signature of the key sharing manager device 1 by checking whether the hash value matches the decryption result.

[0059] If the signature verification means 24 verifies that the signature σ is the signature of the key sharing manager device 1, it outputs the message T to the message processing means 25. However, if the signature σ is not verified as the signature of the key sharing manager device 1, the signature verification means 24 discards the message T.

[0060] The message processing means 25 performs processing corresponding to the message (control message). Here, when the signature verification means 24 verifies that the signature is that of the manager, the message processing means 25 updates the state variable γ with the key information contained in the message in a process corresponding to the message. The processing corresponding to this message is to input the state variable γ stored in the storage means 22 and the message T according to the message processing algorithm ((γ',I)←proc(γ,T)) of the CGKA protocol, and update the state variable γ to γ'.

[0061] Specifically, the message processing means 25 processes the group generation message T cre When a group creation message T cre The message processing means 25 then sends the group generation message T cre Furthermore, the message processing means 25 associates the private key sk with the leaf node of RT corresponding to its own identifier ID.

[0062] The message processing means 25 also processes the member addition message T add When receiving a member addition message T add The processing is changed depending on whether the identifier ID' of the added member included in is the member's own identifier or not.

[0063] If the identifier ID′ is its own identifier, the message processing means 25 sends a member addition message T add The message processing means 25 acquires from the key generation server 3 the public key pk' corresponding to its own identifier ID' included in the message processing means 25 and the private key sk' paired with the public key pk'. Then, the message processing means 25 associates the identifier ID', the public key pk', and the private key sk' with an empty leaf node in the RT of the state variable γ where no member has yet been set. If there is no empty leaf node in the RT, the message processing means 25 adds a leaf node to the RT and associates the identifier ID', the public key pk', and the private key sk'.

[0064] If the identifier ID' is not its own identifier, the message processing means 25 associates the identifier ID' with the public key pk' to an empty leaf node in the RT of the state variable γ where no member has been set yet. If there is no empty leaf node in the RT, the message processing means 25 adds a leaf node to the RT and associates the identifier ID' with the public key pk'.

[0065] The message processing means 25 also processes the member deletion message T rem When a member deletion message T rem The leaf node of RT of the state variable γ corresponding to the identifier ID′ (deletion ID) included in is set as a free leaf node.

[0066] The message processing means 25 also processes the status update message T upd When receiving a member addition message T add A new state variable γ′ is generated by setting a new public key pk to the leaf node corresponding to the identifier ID of the RT of the state variable γ from the identifier ID and public key pk included in the state variable γ. The message processing means 25 stores the new state variable γ′ in the storage means 22 .

[0067] With the configuration described above, the key sharing member device 2 can share key information between the key sharing manager device 1 and the key sharing member devices 2, 2, ... that make up the group. Furthermore, by verifying the signature attached to the message, the key sharing member device 2 can grant the key sharing manager device 1 authority to create a group, etc., thereby realizing one-to-many secure group messaging. The key sharing member device 2 can be operated by a program (key sharing member program) that causes a computer to function as each of the above-mentioned means.

[0068] [Key sharing system operation] Next, the operation of the key sharing system 100 will be described with reference to FIGS. (initialization) First, the initialization process of the key sharing system 100 will be described with reference to FIG. 8 (for the configuration, refer to FIGS. 2 and 6 as appropriate). In this initialization process, the key sharing manager device 1 performs the following steps S1 to S5.

[0069] In step S1, the initialization means 10 acquires its own ID (ID0) from the authentication and distribution server 4. In step S2, the initialization means 10 initializes the state variable γ and stores it in the storage means 12. Here, the initialization means 10 sets the identifier ID0 acquired in step S1 to the state variable γ and initializes the RT of the state variable γ. In step S3, the signature verification key generation means 11 generates a private key for the electronic signature (signature key sk sig ) and the public key for verification (verification key vk sig ) and generate. In step S4, the signature verification key generation means 11 generates the verification key vk generated in step S3. sig is sent to the authentication and distribution server 4. This results in the verification key vk sigis registered in the authentication and delivery server 4. In step S5, the signature verification key generation means 11 generates the signature key sk generated in step S3. sig is stored in the storage means 12.

[0070] On the other hand, the key sharing member device 2 performs the following steps S6 to S9. In step S6, the initialization means 20 receives its own ID (ID i ) to get the In step S7, the initialization means 20 initializes the state variable γ and stores it in the storage means 22. Here, the initialization means 20 initializes the identifier ID acquired in step S6. i is set to the state variable γ, and RT of the state variable γ is initialized. In step S8, the verification key acquisition means 21 acquires the verification key vk generated by the key sharing manager device 1 and registered in the authentication and distribution server 4 in step S4. sig Get. In step S9, the verification key acquisition means 21 acquires the verification key vk acquired in step S8. sig is stored in the storage means 22. Through the above operations, the key sharing manager device 1 and the key sharing member devices 2 are each initialized.

[0071] (Group generation) Next, the group generation process of the key sharing system 100 will be described with reference to FIG. 9 (for the configuration, refer to FIGS. 2, 4, and 6 as appropriate). In this group creation process, the key sharing manager device 1 performs the following steps S10 to S17. It is assumed that the authentication and distribution server 4 has previously collected the identifiers IDs of users (key sharing member devices 2) who wish to join the group.

[0072] In step S10, the group generation means 130 of the message generation means 13 obtains from the authentication and distribution server 4 the identifiers ID (group G=(ID1, ID2, ...)) of the members (key sharing member devices 2, 2, ...) who wish to join the group. In step S11, the group generation means 130 generates a group G by dividing each identifier ID i The public key pk corresponding to i (pk1, pk2, ...) is obtained from the key generation server 3. In step S12, the group generation means 130 generates a public key pk0 and a secret key sk0 corresponding to its own identifier ID0. In step S13, the group generation means 130 sets its own identifier ID0, public key pk0, and secret key sk0 to the leaf node of RT, and also sets the member's identifier ID i and the public key pk i Set the following. In step S14, the group generating means 130 stores the RT generated in step S13 in the state variable γ of the storage means 12.

[0073] In step S15, the group generation means 130 generates a group generation message T cre Generate. In step S16, the signature adding means 14 adds the group creation message T cre Generate a signature (digital signature) σ for In step S17, the signature adding means 14 adds the group generating message T cre and sends the signed group creation message (T cre , σ) to the key sharing member devices 2, 2, . . .

[0074] Then, the key sharing member device 2 performs the following processes of steps S20 to S26. In step S20, the signature verification means 24 receives the signed group creation message (T cre ,σ). In step S21, the signature verification means 24 receives the verification key vk stored in the storage means 22. sig Using the signed group creation message (T cre , σ) is the signature of the key sharing manager device 1. In step S22, the signature verification means 24 determines whether or not the message can be accepted based on the verification result of the signature σ in step S21.

[0075] If it is determined that the message cannot be accepted (No in step S22), the signature verification means 24 cre (not shown as a step). On the other hand, if it is determined that the message can be accepted (Yes in step S22), in step S23, the message processing means 25 cre The public key pk corresponding to the user's own identifier ID included in the key generation server 3 is acquired from the key generation server 3, along with the private key sk that is paired with the public key pk.

[0076] In step S24, the message processing means 25 receives the group generation message T cre The identifier ID and public key pk of the group included in are set as leaf nodes of RT. In step S25, the message processing means 25 sets the secret key sk acquired in step S23 to the leaf node of RT corresponding to its own identifier ID. In step S26, the message processing means 25 stores the RT set in steps S24 and S25 in the state variable γ of the storage means 22. Through the above operations, the key information is shared within the group.

[0077] (Member added) Next, the member addition process of the key sharing system 100 will be described with reference to FIGS. 10 to 12 (for the configuration, see FIGS. 2, 4, and 6 as appropriate).

[0078] In this member addition process, the key sharing manager device 1 performs the following steps S30 to S36, as shown in FIG. In step S30, the member addition means 131 of the message generation means 13 obtains the identifier ID' of the additional member (key sharing member device 2) who wishes to newly join the group from the authentication / distribution server 4 or via an input means (not shown). In step S31, the member addition means 131 acquires, from the key generation server 3, the public key pk' corresponding to the additional identifier ID' acquired in step S30. In step S32, the member addition means 131 sets an identifier ID' and a public key pk' to an empty leaf node of RT to which no member has yet been set. In step S33, the member addition means 131 stores the RT updated in step S32 in the state variable γ of the storage means 12.

[0079] In step S34, the member addition means 131 sends a member addition message T add Generate. In step S35, the signature adding means 14 adds the member addition message T add Generate a signature (digital signature) σ for In step S36, the signature adding means 14 adds the member addition message T add and sends the signed member addition message (T add , σ) to the key sharing member devices 2, 2, . . .

[0080] Then, the key sharing member device 2 that will become a member of the group sends a signed member addition message (T add , σ) and performs member addition processing. Here, the operation differs between a key sharing member device 2 (with identifier ID′) to be added as a new member and a key sharing member device 2 (with identifiers other than ID′) that is already a member.

[0081] First, with reference to FIG. 11, the operation of a key sharing member device 2 (identifier ID′) that is newly added as a member will be described. In step S40, the signature verification means 24 receives a signed member addition message (T add ,σ). In step S41, the signature verification means 24 receives the verification key vk stored in the storage means 22. sig Using the signed member addition message (T add , σ) is the signature of the key sharing manager device 1. In step S42, the signature verification means 24 determines whether or not the message can be accepted based on the verification result of the signature σ in step S41.

[0082] If it is determined that the message cannot be accepted (No in step S42), the signature verification means 24 add (not shown as a step). On the other hand, if it is determined that the message can be accepted (Yes in step S42), in step S43, the message processing means 25 sends the member addition message T add The key generation server 3 obtains the private key sk' that pairs with the public key pk' corresponding to its own identifier ID' included in the key generation server 3.

[0083] In step S44, the message processing means 25 sets an identifier ID', a public key pk', and a secret key sk' to an empty leaf node of RT to which no member has yet been set. In step S45, the message processing means 25 stores the RT set in step S44 in the state variable γ of the storage means 22. As a result, the key information is distributed to the key sharing member devices 2 of the newly added members.

[0084] Next, with reference to FIG. 12, the operation of the key sharing member devices 2 (other than those with identifiers ID') that were already members will be described. The operations in steps S40 to S42 are the same as those described with reference to FIG.

[0085] If it is determined in step S42 that the message can be accepted (Yes in step S42), in step S44B, the message processing means 25 sends a member addition message T add The identifier ID′ and public key pk′ included in the In step S45, the message processing means 25 stores the RT set in step S44B in the state variable γ of the storage means 22. As a result, the key information of the newly added member is set in the key sharing member device 2 that was already a member.

[0086] Although the process of adding a member by the key sharing manager device 1 has been described above, a member may also be added by the key sharing member device 2. In this case, the operation is the same as in the CGKA protocol, and therefore a description thereof will be omitted.

[0087] (Delete member) Next, the member deletion process of the key sharing system 100 will be described with reference to FIG. 13 (for the configuration, refer to FIGS. 2, 4, and 6 as appropriate).

[0088] In this member deletion process, the key sharing manager device 1 performs the following steps S50 to S55. In step S50, the member deletion means 132 of the message generation means 13 obtains the identifier (deletion ID') of the member (key sharing member device 2) to be deleted from the group from the authentication / distribution server 4 or via an input means (not shown). In step S51, the member deletion means 132 deletes the deletion ID' by setting the leaf node corresponding to the deletion ID' of the RT to a free leaf node. In step S52, the member deleting means 132 stores the RT updated in step S51 in the state variable γ of the storage means 12.

[0089] In step S53, the member deletion means 132 sends a member deletion message T rem Generate. In step S54, the signature adding means 14 adds the member deletion message T rem Generate a signature (digital signature) σ for In step S55, the signature adding means 14 adds the member deletion message T rem and sends the signed member deletion message (T rem , σ) to the key sharing member devices 2, 2, . . .

[0090] Then, the key sharing member device 2 performs the following processes of steps S60 to S64. In step S60, the signature verification means 24 receives a signed member deletion message (T rem ,σ). In step S61, the signature verification means 24 receives the verification key vk stored in the storage means 22. sig , and then send the signed member deletion message (T rem , σ) is the signature of the key sharing manager device 1. In step S62, the signature verification means 24 determines whether or not the message can be accepted based on the verification result of the signature σ in step S61.

[0091] If it is determined that the message cannot be accepted (No in step S62), the signature verification means 24 rem (not shown as a step). On the other hand, if it is determined that the message can be accepted (Yes in step S62), in step S63, the message processing means 25 sends the member deletion message T rem The identifier ID' is deleted by setting the leaf node of RT corresponding to the identifier (deletion ID') included in the list to a free leaf node. In step S64, the message processing means 25 stores the RT set in step S63 in the state variable γ of the storage means 22. Through the above operations, the key information of the key sharing member device 2 that has been deleted from the group members is deleted.

[0092] (Status update) Next, the status update process of the key sharing system 100 will be described with reference to Fig. 14 (for the configuration, see Figs. 2, 4, and 6 as appropriate). Here, the process when an event that requires a status update occurs in the key sharing manager device 1 will be described.

[0093] In this state update process, the key sharing manager device 1 performs the following steps S70 to S75. In step S70, when the state update means 133 of the message generation means 13 is instructed to update the state variables via an input means (not shown), it generates a new public key pk0 and private key sk0 of the public key cryptography corresponding to the identifier ID0. In step S71, the state update means 133 sets its own identifier ID0, public key pk0, and secret key sk0 to the leaf node of RT. In step S72, the state update means 133 stores the RT set in step S71 in the state variable γ of the storage means 12.

[0094] In step S73, the state update means 133 sends a state update message T upd Generate. In step S74, the signature adding means 14 adds the status update message T upd Generate a signature (digital signature) σ for In step S75, the signature adding means 14 adds the status update message T upd and sends the signed status update message (T upd , σ) to the key sharing member devices 2, 2, . . .

[0095] Then, the key sharing member device 2 performs the following steps S80 to S84. In step S80, the signature verification means 24 receives a signed status update message (T upd ,σ). In step S81, the signature verification means 24 receives the verification key vk stored in the storage means 22. sig , and the signed state update message (T upd , σ) is the signature of the key sharing manager device 1. In step S82, the signature verification means 24 determines whether or not the message can be accepted based on the verification result of the signature σ in step S81.

[0096] If it is determined that the message cannot be accepted (No in step S82), the signature verification means 24 upd (not shown as a step). On the other hand, if it is determined that the message can be accepted (Yes in step S82), in step S83, the message processing means 25 sends the status update message T upd From the identifier ID0 and public key pk0 included in the RT, a new public key pk0 is set in the leaf node corresponding to the identifier ID0 of the RT. In step S84, the message processing means 25 stores the RT set in step S83 in the state variable γ of the storage means 22. When the state of the key sharing manager device 1 is updated by the above operation, the key information of the key sharing member device 2 that is a member of the group is reflected.

[0097] Although the process of updating the status by the key sharing manager device 1 has been described above, the status may also be updated by the key sharing member device 2. In this case, the operation is the same as in the CGKA protocol, and therefore a description thereof will be omitted.

[0098] Although the embodiment of the present invention has been described above, the present invention is not limited to this embodiment. [Modification] For example, here, the message generation means 13 (FIGS. 2 and 4) of the key sharing manager device 1 is configured to include group generation means 130, member addition means 131, member deletion means 132, and status update means 133. However, if the groups are fixed, such as if there are no changes to the groups initially generated, the message generation means 13 may include at least group generation means 130, and the other components may be any configuration.

[0099] Also, here, the message generation means 23 (FIGS. 6 and 7) of the key sharing member device 2 is configured to include member addition means 231 and status update means 233. However, the key sharing member device 2 may change its authority depending on the application, and may be provided with any of the group generation means 230, member addition means 231, member deletion means 232, and status update means 233 depending on the authority.

[0100] Also, here, the signature verification means 24 (FIG. 6) of the key sharing member device 2 discards messages to which no signature is attached. However, if the key sharing member device 2 forms an equal group with multiple other key sharing member devices 2 and receives a message from one of those members, the message is not discarded but is output to the message processing means 25. [Explanation of symbols]

[0101] 100 Key Sharing System 1. Key sharing manager device 10 Initialization means 11 Signature verification key generation method 12 Memory means 13 Message Generation Methods 130 Group Generation Method 131 Member Addition Method 132 Member deletion method 133 State Update Method 14 Signature addition means 15 Message Processing Methods 2. Key sharing member devices 20 Initialization means 21 Verification key acquisition method 22 Memory means 23 Message Generation Method 24 Signature Verification Method 3 Key generation server 4. Authentication and delivery server

Claims

1. A key sharing system is configured with one key sharing manager device that serves as a manager of a group for sharing a key used for encrypting data, and a plurality of key sharing member devices that serve as members of the group, the key sharing manager device comprising: a signature verification key generation means for generating a signature key and a verification key for an electronic signature; a group generation means for generating a private key and a public key for the manager, acquiring the public keys of the members from a key generation server of a third-party organization, setting the public keys of the members in state variables that store key information, and generating a message that notifies all members of the public keys of the manager and the members in the state variables; a signature adding means for generating a signature for the message using the signature key, adding the signature to the message, and transmitting the signed message to all of the members; A key sharing manager device comprising:

2. 2. The key sharing manager device according to claim 1, further comprising a member addition means for, upon addition of a member, obtaining the public key of the member to be added from the key generation server, setting the public key of the member to be added to the state variable, and generating a message to notify all members of the added public key.

3. 3. The key sharing manager device according to claim 1, further comprising a member deletion means for deleting the public key of the member to be deleted from the state variable when the member is deleted, and generating a message to notify all members of the deleted public key.

4. A key sharing manager device as described in any one of claims 1 to 3, characterized in that it further comprises a state update means for generating a new private key and public key for the manager when updating the manager's key information, setting them in the state variables, and generating a message to notify all members of the generated public key.

5. A key sharing manager program for causing a computer to function as the key sharing manager device according to claim 1 or 4.

Images