Key sharing system, key sharing device, and program

Abstract

According to the present invention, a two-device key is shared between a first key sharing device and a second key sharing device, a group key is shared between the second key sharing device and a third key sharing device, the second key sharing device encrypts the group key using the two-device key to acquire an encrypted group key, and transmits the encrypted group key to the first key sharing device, and the first key sharing device decrypts the encrypted group key using the two-device key.

Description

Key sharing system, key sharing device, and program

[0001] The present invention relates to a key sharing technique.

[0002] In some cases, multiple entities participating in a group share (exchange) the same key to perform encrypted communication. A known key sharing protocol is one in which a key management server generates and manages the key, and the multiple entities share the key. Meanwhile, a distributed group key sharing scheme (group key exchange scheme) (Non-Patent Documents 1 and 2) that does not require a management server has also been proposed.

[0003] Just, M., Vaudenay, S. (1996). "Authenticated multi-party key agreement," In: Kim, K., Matsumoto, T. (eds) Advances in Cryptology ASIACRYPT '96, ASIACRYPT 1996, Lecture Notes in Computer Science, vol 1163. Springer, Berlin, Heidelberg. M. Steiner, G. Tsudik and M. Waidner, "CLIQUES: a new approach to group key agreement," Proceedings, 18th International Conference on Distributed Computing Systems (Cat. No.98CB36183), Amsterdam, Netherlands, 1998, pp. 380-387.

[0004] However, conventional distributed group key sharing methods have the following problems: 1. The parent entity must broadcast, which imposes a heavy processing load. 2. Because broadcast communications occur as many times as there are entities, the parent entity's communication volume increases relative to the number of entities sharing the key.

[0005] In view of these points, the present invention provides a technique for suppressing the concentration of processing load on a specific entity and suppressing an increase in the amount of communication of the specific entity in response to an increase in the number of entities that share a key.

[0006] A two-device key is shared between the first key sharing device and the second key sharing device, a group key is shared between the second key sharing device and the third key sharing device, the second key sharing device encrypts the group key with the two-device key to obtain an encrypted group key, transmits the encrypted group key to the first key sharing device, and the first key sharing device decrypts the encrypted group key with the two-device key.

[0007] This makes it possible to prevent the concentration of processing load on a specific entity and to prevent an increase in the amount of communication of the specific entity in response to an increase in the number of entities that share a key.

[0008] FIG. 1 is a block diagram illustrating the configuration of a key sharing system according to an embodiment. FIG. 2 is a block diagram illustrating the functional configuration of an SAE (Secure Application Entity) device according to an embodiment. FIG. 3 is a block diagram illustrating the functional configuration of a key sharing device according to an embodiment. FIG. 4 is a flow diagram illustrating a key sharing method according to an embodiment. FIG. 5 is a flow diagram illustrating the key sharing method according to an embodiment. FIG. 6 is a diagram illustrating a key sharing list according to an embodiment. FIG. 7 is a flow diagram illustrating the key sharing method according to an embodiment. FIG. 8 is a flow diagram illustrating the key sharing method according to an embodiment. FIG. 9 is a diagram illustrating a hardware configuration according to an embodiment.

[0009] Hereinafter, embodiments of the present invention will be described with reference to the drawings. [First Embodiment] In this embodiment, a two-device key is shared between a first key sharing device and a second key sharing device, and a group key α is shared between the second key sharing device and a third key sharing device. The second key sharing device encrypts the group key α with the two-device key to obtain an encrypted group key and transmits the encrypted group key to the first key sharing device. The first key sharing device decrypts the encrypted group key with the two-device key. This allows a specific entity (key sharing device) to share the group key α without broadcasting. This prevents the processing load from being concentrated on a specific entity, and also prevents an increase in the amount of communication for that specific entity as the number of entities sharing a key increases.

[0010] <Overall Configuration> As shown in FIG. 1, the key sharing system of this embodiment includes an SAE (Secure Application Entity) device 11. １ -1,...11 １ -M １ , …, 11 Ｎ -1,...11 Ｎ -M Ｎ , and key sharing devices 12-1, ..., 12-N. １ , ..., M Ｎ is an integer of 1 or more, and N is an integer of 3 or more. ｎ = 1, ..., M ｎ where n=1, ..., N. SAE device 11 １ -1,...11 １ -M １ , …, 11 Ｎ -1,...11 Ｎ -M Ｎ Each of these is connected to the SAE device 11 ｎ -m ｎ The SAE device 11 １ -1,...11 １ -M １ , …, 11 Ｎ -1,...11 Ｎ -M Ｎare collectively referred to as the SAE device 11. Each of the key sharing devices 12-1, ..., 12-N is collectively referred to as the key sharing device 12-n. The key sharing devices 12-1, ..., 12-N are collectively referred to as the key sharing device 12. The key sharing devices 12-1, ..., 12-N are configured to be able to communicate via a network (NW) 15. Each key sharing device 12-n communicates with the SAE device 11 via each network 16-n. ｎ -1,...11 ｎ -M ｎ The SAE device 11 is configured to be able to communicate with the １ -1,...11 １ -M １ , …, 11 Ｎ -1,...11 Ｎ -M Ｎ are configured to be able to communicate with each other via a network 17. Here, each of the networks 16-1, ..., 16-N will be referred to as a network 16-n, and the networks 16-1, ..., 16-N will be collectively referred to as a network 16. The networks 15, 16, and 17 are communication networks such as the Internet. The networks 15, 16, and 17 may be different from each other, may be the same as each other, or may be partially the same as each other. In this example, it is assumed that all the key sharing devices 12 know which key sharing device 12 the SAE device 11 is configured to be able to communicate with (which key sharing device 12 the SAE device 11 corresponds to). That is, the SAE device 11 ｎ -m ｎ is configured to be able to communicate with the key sharing device 12-n through the network 16-n (SAE device 11 ｎ -m ｎ In this example, all the key sharing devices 12 manage the information (each SAE device 12-n corresponds to a unique ID). For example, the key sharing device 12 uses an ID (SAE ID) to identify the SAE device 11. ｎ -m ｎ can communicate with the key sharing device 12-n through the network 16-n.

[0011] <Configuration of SAE Device> The SAE device 11 is a device that requests key sharing from the key sharing device 12. Hereinafter, a key to be shared by multiple SAE devices 11 will be referred to as a group key. As shown in FIG. 2, each SAE device 11 ｎ -m ｎ The communication unit 110 ｎ -m ｎ , list generation unit 111 ｎ -m ｎ , input unit 112 ｎ -m ｎ , key request unit 113 ｎ -m ｎ , control unit 116 ｎ -m ｎ , memory 117 ｎ -m ｎ , and the storage unit 118 ｎ -m ｎ The SAE device 11 ｎ -m ｎ is the control unit 116 ｎ -m ｎ Each process is performed under the control of the SAE device 11. ｎ -m ｎ and the information input to the SAE device 11 ｎ -m ｎ The information obtained by each part is stored in the memory 117 one by one. ｎ -m ｎ The data is stored in the memory and is read out as needed for other processing.

[0012] <Configuration of Key Sharing Device 12> The key sharing device 12 is a device that shares a group key. As illustrated in FIG. 3, each key sharing device 12-n includes a communication unit 120-n, a two-device key sharing unit 121-n, a group key sharing unit 122-n, an encryption unit 123-n, a decryption unit 124-n, a key ID generation unit 125-n, a control unit 126-n, a memory 127-n, and a storage unit 128-n. The key sharing device 12 executes each process under the control of the control unit 126-n. Information input to the key sharing device 12-n and information obtained by each unit of the key sharing device 12-n are stored in the memory 127-n one by one, and are read out as needed and used for other processes.

[0013] <Key Sharing Process> The key sharing process of this embodiment will be described with reference to Figs. 4 and 5. In this embodiment, an example is shown in which a group key α is shared (exchanged) among K SAE devices 11. Here, K is an integer between 3 and N. In the following, for the sake of simplicity, it is assumed that the K SAE devices 11 ρ（１） −η(1), …, 11 ρ（Ｋ） In this example, {ρ(1),...,ρ(K)} ⊆ {1,...,N}, k = 1,...,K, and η(k)∈{1,...,M ｋ}. That is, the SAE device 11 that shares the group key α ρ（１） −η(1), …, 11 ρ（Ｋ） The key sharing devices 12-ρ(1), ..., 12-ρ(K) with which the group key α can communicate with the same key sharing device 12 are different from each other. However, this does not limit the present invention, and the group key α may be shared among a plurality of SAE devices 11 that can communicate with the same key sharing device 12. In this embodiment, the SAE devices 11 ρ（１） In this example, the SAE device 11 initiates the sharing of the group key α. However, this does not limit the present invention, and any SAE device 11 may initiate the sharing of the group key α.

[0014] <Step S101> As shown in FIG. 4, the SAE device 11 ρ（１） -η(1) (Figure 2: η(1)=m ρ（１） ∈{1,...,M １}) requests the sharing of the group key α. ρ（１） -η(1) input unit 112 ρ（１） -η(1), the SAE device 11 that shares the group key α ρ（１） −η(1), …, 11 ρ（Ｋ） -η(K) is input. The group information may be input by the user, by another system, or from an arbitrary storage unit. The group information may be, for example, information identifying the SAE device 11 (e.g., SAE ID, etc.), or information identifying the user or organization of the SAE device 11 (e.g., user ID, etc.). The group information is stored in the list generation unit 112. ρ（１）-η(1). List generation unit 112 ρ（１） -η(1) is calculated based on the group information by the SAE device 11. ρ（１） −η(1), …, 11 ρ（Ｋ） -η(K), a key sharing list List for sharing the group key α is generated. The key sharing list List is transferred in order to the key sharing devices 12 that share the group key α, and the key sharing devices 12 execute the process for sharing the group key α based on the key sharing list List. This key sharing list List is sent to at least the SAE device 11. ρ（１） −η(1), …, 11 ρ（Ｋ） -η(K). In this embodiment, all key sharing devices 12 know with which key sharing devices 12 the SAE device 11 is configured to be able to communicate. ρ（１） −η(1), …, 11 ρ（Ｋ） The information for identifying −η(K) is the key sharing device 12 ρ（１） −ρ(1), …, 12 ρ（Ｋ） -ρ(K). That is, the key sharing list List is information for identifying at least the key sharing device 12. ρ（１） −ρ(1), …, 12 ρ（Ｋ） -ρ(K) (including the first key sharing device, the second key sharing device, and the third key sharing device). In addition, the key sharing list List contains information for identifying the owner SAE device 11. ρ（１）-η(1). In this embodiment, a two-device key is shared among a pair of key sharing devices 12 corresponding to the SAE devices 11 that share the group key α, and the group key α is shared among a specific pair of key sharing devices 12 corresponding to the SAE devices 11. The group key α is relayed by each pair of key sharing devices 12 repeatedly encrypting and decrypting the group key α using each two-device key. The key sharing list List may include information for specifying this process. For example, the key sharing list List may indicate which pair of key sharing devices 12 corresponding to which SAE devices 11 share the group key α, which pair of key sharing devices 12 corresponding to which SAE devices 11 share the two-device key, the order in which the two-device key is shared, or the order in which the group key α is relayed in its encrypted state. In addition, the key sharing list List may indicate a procedure for dealing with a problem such as a failure. Such a troubleshooting procedure may, for example, be such that, if there is no response from any of the key sharing devices 12 in a series of processes for sharing the group key α, the process with the non-responding key sharing device 12 is canceled and processing is instead performed with another key sharing device 12, or the sharing of the group key α altogether is canceled. In this embodiment, the key sharing device 12 manages which key sharing devices 12 the SAE device 11 can communicate with, and therefore the key sharing list List does not need to include information for identifying the key sharing devices 12 with which the SAE device 11 sharing the group key α can communicate. However, the key sharing list List may include information for identifying the key sharing devices 12 with which the SAE device 11 sharing the group key α can communicate. An example of the key sharing list List is shown in FIG. 6 .6 includes information indicating the owner SAE device 11 ("owner":"SAE1") 1001, an order in which the two-device keys are shared ("request_order":"ascending") 1002, an order in which the group key α is relayed ("key_reley_order":"back to front") 1003, and a list of information indicating the SAE devices 11 that share the group key α ("saeid_list":[SAE1, SAE2, SAE3, SAE4, SAE5]) 1004. The key sharing list List is stored in the storage unit 118. ρ（１） -η(1) and the communication unit 110 ρ（１） -η(1). ρ（１） -η(1) transmits the key sharing list List to the key sharing device 12-ρ(1) via the network 16-ρ(1).

[0015] <Step S102-k (for kε{1, ..., K-2})> The key sharing list List is received by the communication unit 120-ρ(k) of the key sharing device 12-ρ(k) (FIG. 3) and stored in the storage unit 128-ρ(k). ρ（１） −ρ(1), …, 12 ρ（Ｋ－２） -ρ(K-2) (kε{1, ..., K-2}), the two-device key sharing unit 121-ρ(k) shares (exchanges) a two-device key β(k, k+1) (key for key wrap) between the key sharing device 12-ρ(k) (first key sharing device) and the key sharing device 12-ρ(k+1) (second key sharing device) in accordance with the key sharing list List (acquired key sharing list) extracted from the storage unit 128-n. The two-device key β(k, k+1) in this embodiment is a common key (symmetric key) in accordance with a common key cryptosystem. Note that when the key sharing device 12-ρ(k) is the key sharing device 12 ρ（１） −ρ(1), …, 12 ρ（Ｋ－２）-ρ(K-2), and the key sharing device 12-ρ(k+1) can determine based on the key sharing list List. When sharing a two-device key β(k, k+1), the two-device key sharing unit 121-ρ(k) identifies the key sharing device 12-ρ(k+1) according to the key sharing list List, and sends a two-device key sharing request (exchange request) R to the key sharing device 12-ρ(k+1). β (k, k+1) and output the shared request R β (k, k+1) is sent to the communication unit 120-ρ(k), and then transmitted from there to the key sharing device 12-ρ(k+1) via the network 15. β(k, k+1) is received by the communication unit 120-ρ(k+1) of the key sharing device 12-ρ(k+1) (FIG. 3) and sent to the two-device key sharing unit 121-ρ(k+1). This triggers processing for sharing the two-device key β(k, k+1) between the two-device key sharing unit 121-ρ(k) and the two-device key sharing unit 121-ρ(k+1), and the two-device key β(k, k+1) is shared between them. The two-device key β(k, k+1) is shared in accordance with a secure key sharing method. More preferably, the two-device key β(k, k+1) is shared in accordance with a cryptographically secure key sharing method. For example, in a cryptographically secure key agreement method, the two-device key agreement units 121-ρ(k) and 121-ρ(k+1) cannot select a desired two-device key β(k, k+1), but the same two-device key β(k, k+1) can be shared between the two-device key agreement units 121-ρ(k) and 121-ρ(k+1). In such a method, it is possible to prevent an unauthorized two-device key β(k, k+1) from being shared due to unauthorized behavior of at least one of the two-device key agreement units 121-ρ(k) and 121-ρ(k+1). A cryptographically secure key agreement method is, for example, a key agreement method that has IND-CCA security between two parties. Examples of cryptographically secure key sharing methods include the Key Encapsulation Mechanism (KEM) method (Reference 1), the Diffie-Hellman (DH) method, the Elliptic Curve Diffie-Hellman (ECDH) method, the Quantum Key Distribution (QKD) method, and hybrid key exchange methods that combine multiple methods.Reference 1: R. Housley, J. Gray, T. Okubo, "Using Key Encapsulation Mechanism (KEM) Algorithms in the Cryptographic Message Syntax (CMS)", 3 August 2023, LAMPS Working Group, Internet <https: / / www.ietf.org / archive / id / draft-ietf-lamps-cms-kemri-03.html> The two-device key agreement units 121-ρ(k) and 121-ρ(k+1) store the two-device key β(k, k+1) in the storage units 128-ρ(k) and 128-ρ(k+1), respectively. Furthermore, the two-device key agreement unit 121-ρ(k) transmits the key agreement list List to the communication unit 110. ρ（ｋ） -ρ(k) is sent to the communication unit 110. ρ（ｋ） -ρ(k) transmits the key sharing list List to the key sharing device 12-ρ(k+1) (second key sharing device) via the network 15. If kε{1, ..., K−2}, k+1 is set as the new k and step S102-k described above is repeated. If k=K−1 is reached, the next step S103 is executed.

[0016] <Step S103 (When k = K-1)> The key sharing list List is received by the communication unit 120-ρ(K-1) of the key sharing device 12-ρ(K-1) (FIG. 3) and stored in the memory unit 128-ρ(K-1). The group key sharing unit 122-ρ(K-1) of the key sharing device 12-ρ(K-1) shares (exchanges) a group key α between the key sharing device 12-ρ(K-1) (second key sharing device) and the key sharing device 12-ρ(K) (third key sharing device) in accordance with the key sharing list List extracted from the memory unit 128-ρ(K-1). The group key α is a common key conforming to a common key cryptosystem. Whether the key sharing device is 12-ρ(K-1) and the key sharing device 12-ρ(K) can be determined based on the key sharing list List. When sharing the group key α, the group key sharing unit 122-ρ(K-1) identifies the key sharing apparatus 12-ρ(K) in accordance with the key sharing list List, for example, and sends a sharing request (exchange request) R for the group key α to the key sharing apparatus 12-ρ(K).α The sharing request R α is sent to the communication unit 120-ρ(K-1), and then transmitted from there to the sharing device 12-ρ(K) via the network 15. α is received by the communication unit 120-ρ(K) of the key sharing device 12-ρ(K (FIG. 3) and sent to the group key sharing unit 122-ρ(K). This triggers processing for sharing the group key α between the group key sharing units 122-ρ(K-1) and 122-ρ(K), and the group key α is shared between them. The group key α is shared in accordance with a secure key sharing method. It is more preferable that the group key α be shared in accordance with a cryptographically secure key sharing method. A cryptographically secure key sharing method is, for example, a key sharing method that has IND-CCA security between two parties. Examples of cryptographically secure key sharing methods include the KEM method, the DH method, the ECDH method, the QKD method, and the hybrid key exchange method. The group key sharing units 122-ρ(K−1) and 122-ρ(K) store the group key α in the storage units 128-ρ(K−1) and 128-ρ(K), respectively. ρ（Ｋ－１） -ρ(K−1) transmits the key sharing list List to the key sharing device 12-ρ(K) via the network 15.

[0017] <Step S104-(K-1)> The group key α and the two-device key β(K-2, K-1) are stored in the storage unit 128-ρ(K-1) of the key sharing device 12-ρ(K-1) (second key sharing device) (FIG. 3). The encryption unit 123-ρ(K-1) extracts the group key α and the two-device key β(K-2, K-1) from the storage unit 128-ρ(K-1), encrypts (wraps) the group key α with the two-device key β(K-2, K-1), and generates the encrypted group key C Ｋ－２，Ｋ－１ In this embodiment, the group key α is encrypted with the two-device key β(K-2, K-1) in accordance with the common key cryptosystem to obtain the encrypted group key C Ｋ－２，Ｋ－１It is desirable that this process be performed in accordance with a cryptographically secure key encryption method. An example of a cryptographically secure key encryption method is the key wrap method (see, for example, Reference 2). Reference 2: "RFC 5649 - Advanced Encryption Standard (AES) Key Wrap with Padding Algorithm", Internet <https: / / tex2e.github.io / rfc-translater / html / rfc5649.html> Encrypted group key C Ｋ－２，Ｋ－１ The communication unit 120-ρ(K-1) receives the encrypted group key C via the network 15. Ｋ－２，Ｋ－１ is transmitted (relayed) to the key sharing device 12-ρ(K-2) (first key sharing device).

[0018] <Step S105-(K-2)> The encrypted group key C transmitted from the key sharing device 12-ρ(K-1) is Ｋ－２，Ｋ－１ is received by the communication unit 120-ρ(K-2) of the key sharing device 12-ρ(K-2) (first key sharing device) (FIG. 3). Ｋ－２，Ｋ－１ is sent to the decryption unit 124-ρ(K-2). The storage unit 128-ρ(K-2) of the key sharing device 12-ρ(K-2) stores the two-device key β(K-2, K-1). The decryption unit 124-ρ(K-2) extracts the two-device key β(K-2, K-1) from the storage unit 128-ρ(K-2) and uses the two-device key β(K-2, K-1) to decrypt the encrypted group key C Ｋ－２，Ｋ－１ is decrypted (unwrapped) to obtain the group key α=dec(β(K-2, K-1), C Ｋ－２，Ｋ－１ In this embodiment, the encrypted group key C is obtained in accordance with the common key cryptosystem used in step S104-(K-1). Ｋ－２，Ｋ－１ The group key α is stored in the storage unit 128-ρ(K-2).

[0019] <Step S104-k (kε{2, ..., K-2})> Group keys α and β(k-1, k) are stored in the storage unit 128-ρ(k) of the key sharing device 12-ρ(k) (second key sharing device) (FIG. 3). The encryption unit 123-ρ(k) extracts the group key α and the two-device key β(k-1, k) from the storage unit 128-ρ(k), encrypts (wraps) the group key α with the two-device key β(k-1, k), and generates the encrypted group key C ｋ－１，ｋ In this embodiment, the group key α is encrypted with the two-device key β(k−1, k) in accordance with the common key cryptosystem to obtain the encrypted group key C ｋ－１，ｋ It is desirable that this process be performed in accordance with a cryptographically secure key encryption method. An example of a cryptographically secure key encryption method is the key wrap method. The encrypted group key C ｋ－１，ｋ is sent to the communication unit 120-ρ(k). The communication unit 120-ρ(k) receives the encrypted group key C via the network 15. ｋ－１，ｋ is transmitted (relayed) to the key sharing device 12-ρ(k−1) (first key sharing device).

[0020] <Step S105-(k-1) (kε{2, . . . , K-2})> The encrypted group key C transmitted from the key sharing device 12-ρ(k) is ｋ－１，ｋ is received by the communication unit 120-ρ(k−1) of the key sharing device 12-ρ(k−1) (first key sharing device) (FIG. 3). ｋ－１，ｋ is sent to the decryption unit 124-ρ(k-1). The storage unit 128-ρ(k-1) of the key sharing device 12-ρ(k-1) stores the two-device key β(k-1, k). The decryption unit 124-ρ(k-1) extracts the two-device key β(k-1, k) from the storage unit 128-ρ(k-1) and uses the two-device key β(k-1, k) to decrypt the encrypted group key C ｋ－１，ｋ is decrypted (unwrapped) to obtain the group key α=dec(β(k−1, k), C ｋ－１，ｋ In this embodiment, the encrypted group key C is obtained in accordance with the common key cryptosystem used in step S104-(k). ｋ－１，ｋ The group key α is stored in the storage unit 128-ρ(k−1).

[0021] If k>2, k-1 is set as the new k, and the process returns to step S104-k. On the other hand, if k=2, the key sharing device 12 ρ（１） −ρ(1), …, 12 ρ（Ｋ） -ρ(K) (FIG. 3). The group key α is stored in each of the storage units 128-ρ(1), ..., 128-ρ(K). That is, if k=2, the key sharing device 12 ρ（１） −ρ(1), …, 12 ρ（Ｋ） In this case, the process proceeds to the next step 106.

[0022] <Step S106> As illustrated in FIG. 5, the key sharing device 12 ρ（１） The key ID generation unit 125-ρ(1) of the group key α-ρ(1) (FIG. 3) generates the key ID id corresponding to the group key α stored in the storage unit 128-ρ(1). α The key ID generation unit 125-ρ(1) generates the key ID id α and the group key α (id α , α) is stored in the storage unit 128-ρ(1), and the key ID id α is sent to the communication unit 120-ρ(1).

[0023] <Step S107> Key sharing device 12 ρ（１） The communication unit 120-ρ(1) of the key sharing device 12-ρ(1) (FIG. 3) extracts the key sharing list List from the storage unit 128-ρ(1) and sends the key sharing list List to the key sharing device 12 specified by the key sharing list List. ρ（２） −ρ(2), …, 12 ρ（Ｋ） -ρ(K) via the network 15 α Send the key ID id α is the key sharing device 12 ρ（２） −ρ(2), …, 12 ρ（Ｋ） -ρ(K) is received by the communication units 120-ρ(2), ..., 120-ρ(K). Key ID id α and the group key α (id α , α) are stored in storage units 128-ρ(2), ..., 128-ρ(K).

[0024] <Step S108> Key sharing device 12 ρ（１） -ρ(1) (FIG. 3)α , α) and the key sharing list List are sent to the communication unit 120-ρ(1). The communication unit 120-ρ(k) receives the set (id α , α) via the network 16-ρ(k) to the SAE device 11 specified by the key sharing list List. ρ（１） -η(1). α , α) is the SAE device 11 ρ（１） -η(1) (FIG. 2) communication unit 110 ρ（１） -η(1) and stored in the storage unit 118 ρ（１） -η(1).

[0025] <Step S109> SAE device 11 ρ（１） -η(1) (FIG. 2) communication unit 110 ρ（１） -η(1) is stored in the storage unit 118 ρ（１） -η(1) to the key sharing list List and key ID id α and the SAE device 11 specified by the key sharing list List. ρ（２） −η(2), …, 12 ρ（Ｋ） -η(K), the key ID id α and requests acquisition of the group key α. α The request to acquire the group key α is sent to the SAE device 11. ρ（２） −η(2), …, 12 ρ（Ｋ） -η(K) communication unit 110 ρ（２） -η(2),...,110 ρ（Ｋ） -η(K) and the key request unit 113 ρ（２） -η(2),...,113 ρ（Ｋ） −η(K).

[0026] <Step S110-k (kε{2, ..., K})> SAE device 11 ρ（ｋ） -η(k) (kε{2, . . . , K}) (FIG. 2) key request unit 113 ρ（ｋ） -η(k) is the key ID id α The communication unit 110 sends a request to acquire the group key α. ρ（ｋ） -η(k). ρ（ｋ） -η(k) is the key ID id α A request to acquire the group key α accompanied by the following is sent to the key sharing device 12 via the network 16-ρ(k).ρ（ｋ） - Send to ρ(k). Key ID id α The request to acquire the group key α is sent to the key sharing device 12 ρ（ｋ） The communication unit 120-ρ(k) of the key ID id α The group key α corresponding to the group key α is extracted from the storage unit 128-ρ(k) and transmitted to the SAE device 11 via the network 16-ρ(k). ρ（ｋ） -η(k). The group key α is transmitted to the SAE device 11. ρ（ｋ） -η(k) (FIG. 2) communication unit 110 ρ（ｋ） -η(k) and the key ID id α and the group key α (id α , α) are stored in the storage unit 118 ρ（ｋ） −η(k). By performing this process for k=2, . . . , K, the K SAE devices 11 ρ（１） −η(1), …, 11 ρ（Ｋ） A group key α is shared among −η(K).

[0027] <Characteristics of this embodiment> In this embodiment, a key sharing device 12-ρ(k) (first key sharing device) and a key sharing device 12-ρ(k+1) (second key sharing device) that share a group key share a two-device key β(k, k+1) (key for key wrap) (k=1, ..., K-2), a group key α is shared between a key sharing device 12-ρ(K-1) (second key sharing device) and a key sharing device 12-ρ(K) (third key sharing device), and the key sharing device 12-ρ(k) (second key sharing device) (k=2, ..., K-1) encrypts the group key α with the two-device key β(k-1, k) to generate an encrypted group key C ｋ－１，ｋ and transmits the encrypted group key to the key sharing device 12-ρ(k−1) (first key sharing device), which then uses the two-device key β(k−1, k) to generate the encrypted group key C ｋ－１，ｋto obtain the group key α. This allows multiple entities (SAE device 11 and key sharing device 12) to share the group key α without a specific entity performing broadcast communication as in the past. This makes it possible to prevent the processing load from concentrating on a specific entity (a specific SAE device 11 or a specific key sharing device 12). Furthermore, because broadcast communication by a specific entity is not required, it is possible to prevent an increase in the amount of communication by a specific entity (a specific SAE device 11 or a specific key sharing device 12) in response to an increase in the number of entities (SAE device 11 or a key sharing device 12) that share the group key α.

[0028] In this embodiment, the key sharing device 12-ρ(k) (first key sharing device) and the key sharing device 12-ρ(k+1) (second key sharing device) share a two-device key β(k, k+1) securely, and the key sharing device 12-ρ(K-1) (second key sharing device) and the key sharing device 12-ρ(K) (third key sharing device) share a group key α securely to perform the above-mentioned processing. ρ（１） −η(1), …, 11 ρ（Ｋ） -η(K) can be used to share the group key α securely. If these are cryptographically secure, the group key α can be shared in a cryptographically secure manner (for example, IND-CCA secure).

[0029] In this embodiment, a two-device key β(k, k+1) is shared between key sharing device 12-ρ(k) (first key sharing device) and key sharing device 12-ρ(k+1) (second key sharing device) in accordance with the key sharing list List, and a group key α is shared between key sharing device 12-ρ(K-1) (second key sharing device) and key sharing device 12-ρ(K) (third key sharing device) in accordance with the key sharing list List. As a result, key sharing devices 12-ρ(1), ..., 12-ρ(K) and SAE device 11 can share a group key α by performing processing in accordance with the key sharing list List without the key sharing device 12 knowing the roles of each device in advance. ρ（１） −η(1), …, 11 ρ（Ｋ） −η(K) can be used to perform processing for sharing the group key α.

[0030] [First Modification of the First Embodiment] A process may be executed to confirm that the same group key α has been shared among the key sharing devices 12-ρ(1), ..., 12-ρ(K). That is, as shown in Fig. 3, the key sharing device 12-n may further include a key sharing confirmation unit 129-n, and the confirmation process shown in Fig. 7 may be executed between steps S107 and S108 of the first embodiment.

[0031] In this case, after the process of step S107, the key sharing device 12 ρ（１） The key sharing verification unit 129-ρ(1) of the key sharing unit 129-ρ(1) (FIG. 3) receives the key ID id α and use this as a challenge C=id α The communication unit 120-ρ(1) sends the challenge C α , 12-ρ(K) via the network 15 (step S110). The communication unit 120-ρ(k) of the key sharing device 12-ρ(k) (k=2, ..., K) (FIG. 3) receives the challenge C and sends it to the key sharing confirmation unit 129-ρ(k). The key sharing confirmation unit 129-ρ(k) receives the challenge C=id from the storage unit 128-ρ(k). α The set (id α , α), and a challenge C=id α Encrypt the response (ciphertext) R ｋ = enc(α, id α ) to generate a response R ｋ is sent to the communication unit 120-ρ(k), and then transmitted from there to the key sharing device 12-ρ(1) via the network 15 (step S111-k (k=2, . . . , K)). ｋ is the key sharing device 12 ρ（１） The key agreement confirmation unit 129-ρ(1) receives the pair (id α , α) and extract the set (id α , α) and the response R ｋ The decryption result obtained by decryptingα , α) key ID id α (Challenge C=id α The key sharing verification unit 129-ρ(1) verifies whether the decryption result matches the key ID id for all k=2, ..., K. α If the results match, the key sharing confirmation unit 129-ρ(1) outputs a confirmation result indicating that it has been confirmed that the same group key α has been shared among the key sharing devices 12-ρ(1), ..., 12-ρ(K). If not, the sharing confirmation unit 129-ρ(1) outputs a confirmation result indicating that it has not been confirmed that the same group key α has been shared among the key sharing devices 12-ρ(1), ..., 12-ρ(K).

[0032] [Second Modification of First Embodiment] In the first embodiment, first, a two-device key β(k, k+1) (key for key wrap) is shared between the key sharing device 12-ρ(k) (first key sharing device) and the key sharing device 12-ρ(k+1) (second key sharing device) (k=1, ..., K-2) (steps S102-1, ..., S102-(K-1)). Thereafter, a group key α is shared between the key sharing device 12-ρ(K-1) (second key sharing device) and the key sharing device 12-ρ(K) (third key sharing device) (step S103). Thereafter, the key sharing device 12-ρ(k) (second key sharing device) (k=2, ..., K-1) encrypts the group key α with the two-device key β(k-1, k) to generate an encrypted group key C. ｋ－１，ｋ and transmits the encrypted group key to the key sharing device 12-ρ(k-1) (first key sharing device) (steps S104-2, ..., S104-(K-1)). The key sharing device 12-ρ(k-1) (first key sharing device) then obtains the encrypted group key C ｋ－１，ｋ and obtains the group key α (steps S105-1, . . . , S105-(K-2)).

[0033] However, it is also possible to first share the group key α between two key sharing devices 12, then share the two-device key β, transmit (relay) a ciphertext obtained by encrypting the group key α with the two-device key β, and then decrypt the ciphertext using the two-device key β. The key sharing process of this variant will be described below with reference to FIG. 8.

[0034] <Step S101> This is the same as in the first embodiment.

[0035] <Step S103> The key sharing list List is received by the communication unit 120-ρ(1) of the key sharing device 12-ρ(1) (FIG. 3) and stored in the memory unit 128-ρ(1). The group key sharing unit 122-ρ(1) of the key sharing device 12-ρ(1) (the third key sharing device that obtained the key sharing list) shares (exchanges) the group key α between the key sharing device 12-ρ(1) (the third key sharing device) and the key sharing device 12-ρ(2) (the second key sharing device) in accordance with the key sharing list List extracted from the memory unit 128-n. The group key sharing units 122-ρ(1) and 122-ρ(2) store the group key α in the memories 128-ρ(1) and 128-ρ(2), respectively. The communication unit 110 ρ（１） -ρ(1) transmits the key sharing list List via the network 15 to the key sharing device 12-ρ(2) (second key sharing device).

[0036] <Step S102-k (kε{2, ..., K−1})> The key sharing list List is received by the communication unit 120-ρ(k) of the key sharing device 12-ρ(k) (FIG. 3) and stored in the memory unit 128-ρ(k). The two-device key sharing unit 121-ρ(k) (second key sharing device) shares (exchanges) a two-device key β(k, k+1) (key for key wrap) between the key sharing device 12-ρ(k) (second key sharing device) and the key sharing device 12-ρ(k+1) (first key sharing device) in accordance with the key sharing list List (acquired key sharing list) extracted from the memory unit 128-n. The two-device key sharing units 121-ρ(k) and 121-ρ(k+1) store the two-device key β(k, k+1) in the storage units 128-ρ(k) and 128-ρ(k+1), respectively. Furthermore, the two-device key sharing unit 121-ρ(k) sends the key sharing list List to the communication unit 110. ρ（ｋ） -ρ(k) is sent to the communication unit 110. ρ（ｋ） −ρ(k) transmits the key sharing list List to the key sharing device 12-ρ(k+1) via the network 15 .

[0037] <Step S104-k (kε{2, ..., K-1})> Group keys α and β(k, k+1) are stored in the storage unit 128-ρ(k) of the key sharing device 12-ρ(k) (second key sharing device) (FIG. 3). The encryption unit 123-ρ(k) extracts the group key α and the two-device key β(k, k+1) from the storage unit 128-ρ(k), encrypts (wraps) the group key α with the two-device key β(k, k+1), and generates the encrypted group key C ｋ，ｋ＋１ =enc(β(k, k+1), α). ｋ，ｋ＋１ is sent to the communication unit 120-ρ(k). The communication unit 120-ρ(k) receives the encrypted group key C via the network 15. ｋ，ｋ＋１ is transmitted (relayed) to the key sharing device 12-ρ(k+1) (first key sharing device).

[0038] <Step S105-(k+1) (kε{2, . . . , K−1})> The encrypted group key C transmitted from the key sharing device 12-ρ(k) is ｋ，ｋ＋１ is received by the communication unit 120-ρ(k+1) of the key sharing device 12-ρ(k+1) (first key sharing device) (FIG. 3). ｋ，ｋ＋１ is sent to the decryption unit 124-ρ(k+1). The storage unit 128-ρ(k+1) of the key sharing device 12-ρ(k+1) stores the two-device key β(k, k+1). The decryption unit 124-ρ(k+1) extracts the two-device key β(k, k+1) from the storage unit 128-ρ(k+1) and uses the two-device key β(k, k+1) to decrypt the encrypted group key C ｋ，ｋ＋１ is decrypted (unwrapped) to obtain the group key α=dec(β(k, k+1), C ｋ，ｋ＋１ In this embodiment, the encrypted group key C is obtained in accordance with the common key cryptosystem used in step S104-(k). ｋ，ｋ＋１ The group key α is stored in the storage unit 128-ρ(k+1).

[0039] Through the above process, the key sharing device 12 ρ（１） −ρ(1), …, 12 ρ（Ｋ） The group key α is shared by −ρ(K). Then, the process proceeds to step 106 (FIG. 5).

[0040] [Third Modification of the First Embodiment] In the first embodiment, each key sharing device 12-ρ(k) (kε{1, . . . , K}) that shares the group key α is connected to one SAE device 11 ρ（ｋ） -η(k) (steps S108, 110-2, ..., 110-K). However, in the first embodiment and its modifications, at least one of the key sharing devices 12-ρ(k) (kε{1, ..., K}) that share the group key α may transmit the group key α to multiple SAE devices 11. For example, the key sharing device 12-ρ(k) (kε{1, ..., K}) may transmit the group key α to all SAE devices 11 that can communicate via the network 16-k.

[0041] The group key α may be encrypted when the key sharing device 12 transmits it to the SAE device 11 via the network 16. For example, a two-device key may be shared between the key sharing device 12 and the SAE device 11, which are capable of communicating via the network 16 (e.g., KEM or DH), and the key sharing device 12 may encrypt the group key α with the two-device key in accordance with a common key cryptosystem (e.g., key wrap system) and transmit the resulting ciphertext to the SAE device 11 via the network 16. The SAE device 11 may then decrypt the encrypted text using the two-device key to obtain the group key α.

[0042] At least one of the SAE devices 11 ｎ -m ｎ In this case, the key sharing device 12-n may be integrated with the SAE device 11. ｎ -m ｎ Therefore, the process of transmitting the group key α to the

[0043] A key ID may be generated for the two-device key β, and the two-device key β may be identified based on the key ID.

[0044] [Hardware Configuration] The functions performed by the components described herein may be implemented in circuitry or processing circuitry, including general-purpose processors, application-specific processors, integrated circuits, ASICs (Application Specific Integrated Circuits), a CPU (a Central Processing Unit), conventional circuits, and / or combinations thereof, programmed to perform the described functions. A processor includes transistors and other circuits and is considered to be circuitry or processing circuitry. A processor may also be a programmed processor that executes a program stored in a memory.

[0045] In this specification, a circuitry, unit, or means is hardware that is programmed to realize or performs the described functions, which may be any hardware disclosed herein or any hardware known to be programmed to realize or perform the described functions.

[0046] If the hardware is a processor considered to be a type of circuitry, the circuitry, means, or unit is a combination of the hardware and software used to configure the hardware and / or processor.

[0047] For example, the SAE device 11 and the key sharing device 12 in each embodiment are devices configured by a general-purpose or dedicated computer including, for example, a processor (hardware processor) such as a central processing unit (CPU) and memories such as random-access memory (RAM) and read-only memory (ROM) executing a predetermined program. That is, the SAE device 11 and the key sharing device 12 in each embodiment have, for example, processing circuitry configured to implement each of the components thereof. This computer may include one processor and memory, or multiple processors and memories. This program may be installed on the computer or may be pre-recorded in a ROM or the like. Furthermore, some or all of the processing units may be configured using electronic circuits that independently realize processing functions, rather than electronic circuits that realize functional configurations by loading programs, such as a CPU. Furthermore, the electronic circuits constituting one device may include multiple CPUs.

[0048] FIG. 9 is a block diagram illustrating the hardware configuration of the SAE device 11 and the key sharing device 12 in each embodiment. As illustrated in FIG. 9, the SAE device 11 and the key sharing device 12 in this example include a central processing unit (CPU) 10a, an input unit 10b, an output unit 10c, a random access memory (RAM) 10d, a read-only memory (ROM) 10e, an auxiliary storage device 10f, a communication unit 10h, and a bus 10g. The CPU 10a in this example includes a control unit 10aa, an arithmetic unit 10ab, and a register 10ac, and executes various arithmetic processes according to various programs loaded into the register 10ac. The input unit 10b is an input terminal, keyboard, mouse, touch panel, etc., through which data is input. The output unit 10c is an output terminal, display, etc., through which data is output. The communication unit 10h is a LAN card, etc., controlled by the CPU 10a that has loaded a predetermined program. The RAM 10d is a static random access memory (SRAM), dynamic random access memory (DRAM), or the like, and has a program area 10da where predetermined programs are stored and a data area 10db where various data are stored. The auxiliary storage device 10f is a hard disk, magneto-optical disc (MO), semiconductor memory, or the like, and has a program area 10fa where predetermined programs are stored and a data area 10fb where various data are stored. The bus 10g connects the CPU 10a, input unit 10b, output unit 10c, RAM 10d, ROM 10e, communication unit 10h, and auxiliary storage device 10f so that information can be exchanged. The CPU 10a writes the program stored in the program area 10fa of the auxiliary storage device 10f to the program area 10da of RAM 10d in accordance with the loaded OS (Operating System) program. Similarly, the CPU 10a writes various data stored in the data area 10fb of the auxiliary storage device 10f to the data area 10db of the RAM 10d. The addresses in the RAM 10d where the programs and data are written are then stored in the register 10ac of the CPU 10a.The control unit 10aa of the CPU 10a sequentially reads out these addresses stored in the register 10ac, reads out programs and data from the areas on the RAM 10d indicated by the read addresses, causes the calculation unit 10ab to sequentially execute the calculations indicated by the programs, and stores the calculation results in the register 10ac. With this configuration, the functional configuration of the SAE device 11 and the key sharing device 12 is realized.

[0049] The program describing this processing can be recorded on a computer-readable recording medium. Examples of computer-readable recording media are non-transitory recording media. Examples of such recording media include magnetic recording devices, optical disks, magneto-optical recording media, and semiconductor memories.

[0050] The program may be distributed by, for example, selling, transferring, lending, etc. portable recording media such as DVDs and CD-ROMs on which the program is recorded. Furthermore, the program may be stored in a storage device of a server computer, and then transferred from the server computer to other computers via a network, thereby distributing the program.

[0051] A computer that executes such a program may first temporarily store the program recorded on a portable recording medium or transferred from a server computer in its own storage device. Then, when executing a process, the computer reads the program stored on its own recording medium and executes the process in accordance with the read program. Alternatively, the computer may read the program directly from a portable recording medium and execute the process in accordance with the program. Furthermore, the computer may execute the process in accordance with the program each time a program is transferred from a server computer to the computer. Alternatively, the server computer may not transfer the program to the computer, but may instead execute the process through a so-called ASP (Application Service Provider) service, which realizes the processing function by issuing an execution instruction and obtaining the results. Furthermore, the server computer may execute the process at the terminal using a so-called SaaS (Software as a Service) service, which allows users to use part of a server computer along with the program. In this embodiment, the program includes information used for processing by an electronic computer that is equivalent to a program (such as data that is not a direct instruction to a computer but has properties that dictate computer processing).

[0052] Furthermore, in this embodiment, the device is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

[0053] [Other Modifications] The present invention is not limited to the above-described embodiments. For example, the various processes described above may not only be executed in chronological order as described, but may also be executed in parallel or individually depending on the processing capabilities of the devices that execute the processes or as needed. Needless to say, other modifications are possible within the scope of the present invention.

[0054] REFERENCE SIGNS LIST 1 Key sharing system 11 SAE device 12 Key sharing device 121 Two-party key sharing unit 122 Group key sharing unit 123 Encryption unit 124 Decryption unit 15, 16, 17 Network

Claims

1. A key sharing system comprising a first key sharing device, a second key sharing device, and a third key sharing device, wherein a two-device key is shared between the first key sharing device and the second key sharing device, a group key is shared between the second key sharing device and the third key sharing device, the second key sharing device encrypts the group key with the two-device key to obtain an encrypted group key and sends the encrypted group key to the first key sharing device, and the first key sharing device decrypts the encrypted group key with the two-device key.

2. A key sharing system according to claim 1, wherein the two-device key is shared between the first key sharing device and the second key sharing device in accordance with a key sharing list including at least information for identifying the first key sharing device, the second key sharing device, and the third key sharing device, and the group key is shared between the second key sharing device and the third key sharing device in accordance with the key sharing list.

3. A key sharing system according to claim 2, wherein the first key sharing device shares the two-device key with the second key sharing device in accordance with the acquired key sharing list and sends the key sharing list to the second key sharing device, and the second key sharing device shares the group key with the third key sharing device in accordance with the acquired key sharing list.

4. A key sharing system according to claim 2, wherein the third key sharing device, having acquired the key sharing list, shares the group key with the second key sharing device and sends the key sharing list to the second key sharing device, and the second key sharing device shares the two-device key with the first key sharing device in accordance with the acquired key sharing list.

5. A key sharing device comprising: a two-device key sharing unit that shares a two-device key with a first key sharing device; a group key sharing unit that shares a group key with a third key sharing device; an encryption unit that encrypts the group key with the two-device key to obtain an encrypted group key; and a communication unit that transmits the encrypted group key to the first key sharing device.

6. A key sharing device according to claim 5, wherein the two-device key sharing unit shares the two-device key with the first key sharing device in accordance with a key sharing list including at least information for identifying the first key sharing device and the third key sharing device, and the encryption unit shares the group key with the third key sharing device in accordance with the key sharing list.

7. A key sharing device which is the first key sharing device, the second key sharing device or the third key sharing device included in the key sharing system of any one of claims 1 to 4.

8. A program for causing a computer to function as the key sharing device of claim 7.

Images