Arithmetic device, terminal device, network, arithmetic method, and program

Abstract

This arithmetic device causes execution of: an extraction step for extracting a bit string having the same bit length as the bit length of an input key to be used in a prescribed algorithm when the bit length of a common key is longer than the bit length of the input key; an encryption step for generating ciphertext by executing encryption processing on a prescribed plaintext agreed between a terminal device and a network by using the extracted bit string as a key; and a key generation step for, when the bit length of the generated ciphertext is shorter than the bit length obtained by multiplying the bit length of the input key by an integer, repeatedly executing said processing until the bit length obtained by adding the generated ciphertext becomes longer than the bit length obtained by multiplying the bit length of the input key by an integer, dividing the obtained bit string for each bit length of the input key, and generating a key having the same bit length as the bit length of the input key on the basis of a plurality of bit strings obtained by the dividing.

Description

Arithmetic device, terminal device, network, arithmetic method and program

[0001] The present invention relates to a computing device, a terminal device, a network, a computing method, and a program. This application claims priority to Japanese Patent Application No. 2024-154898, filed on September 9, 2024, the contents of which are incorporated herein by reference.

[0002] Conventional 3GPP (registered trademark) specifications are formulated on the premise that a 128-bit key is assigned to a 128-bit cipher. For example, Non-Patent Document 1 defines specific specifications for such a technology.

[0003] 3GPP, "TS 33.501", v18.5.0

[0004] Discussions are currently underway to introduce 256-bit encryption. When 256-bit encryption is introduced, it is expected that 128-bit encryption and 256-bit encryption will coexist. In such cases, there is a demand for using a 256-bit key with 128-bit encryption. That is, there is a demand for compressing the bit length of a given key to generate a key with the same size as the key used in the encryption algorithm.

[0005] The present invention has been made in consideration of the above circumstances, and its purpose is to provide a computing device, a terminal device, a network, a computing method, and a program that are capable of compressing the bit length of a given key and generating a key equal to the key size used in a cryptographic algorithm.

[0006] (1) One aspect of the present invention is an arithmetic device that causes a computer having at least a processor and a memory to execute the following steps: an extraction step of extracting a bit string having the same bit length as the bit length of the input key by extracting a bit string corresponding to the bit length of the input key from a bit string contained in the common key, when the bit length of the common key assigned for use in communication between a terminal device and a network is longer than the bit length of an input key used in a predetermined algorithm; an encryption step of generating a ciphertext by performing encryption processing of a predetermined plaintext agreed upon between the terminal device and the network, using the bit string extracted by the extraction step as a key; and a key generation step of repeating the encryption step again, when the bit length of the ciphertext generated by the encryption step is shorter than an integer multiple of the bit length of the input key, until the total bit length of the generated ciphertexts becomes longer than an integer multiple of the bit length of the input key, dividing the bit string obtained by the repeated processing into bits of the input key, and generating a key having the same bit length as the input key based on the multiple bit strings obtained by the division. (2) According to another aspect of the present invention, in the arithmetic device described in (1) above, the extraction step extracts a bit string corresponding to the bit length of the input key from the beginning of the bit string contained in the common key. (3) According to another aspect of the present invention, in the arithmetic device described in (1) or (2) above, the key generation step generates a key having the same bit length as the input key by calculating an exclusive OR of multiple bit strings obtained by division. (4) According to another aspect of the present invention, in the arithmetic device described in any of (1) to (3) above, if, as a result of dividing the input key by bit length, the divided bit strings are not an integer multiple of the number of bits of the input key, the key generation step increases the number of bits by padding so that the divided bit strings are an integer multiple of the number of bits of the input key. (5) According to another aspect of the present invention, in the arithmetic device described in any of (1) to (4) above, the predetermined plaintexts used in the encryption step differ from one another depending on the number of iterations performed in the key generation step.(6) According to another aspect of the present invention, in the arithmetic device described in any one of (1) to (4) above, the predetermined plaintext used in the encryption step is a time-dependent variable agreed upon in advance between the terminal device and the network. (7) According to another aspect of the present invention, in the arithmetic device described in any one of (1) to (6) above, the bit length of the predetermined plaintext used in the encryption step is the same as the bit length of the input key divided by n, a natural number greater than or equal to 1, and the key generation step generates a key having a bit length that is an integer multiple of the bit length of the input key by repeating the encryption step n times. (8) According to another aspect of the present invention, in the arithmetic device described in any one of (1) to (7) above, the encryption step generates ciphertext using an Advanced Encryption Standard (AES) method or a stream cipher method. (9) Also, one aspect of the present invention is the arithmetic device according to any one of (1) to (8) above, wherein the bit length of the common key is 256 bits and the bit length of the input key is 128 bits. (10) Another aspect of the present invention is a terminal device including the arithmetic device according to any one of (1) to (9) above. (11) Another aspect of the present invention is a network including the arithmetic device according to any one of (1) to (9) above. (12) Another aspect of the present invention is the network according to (11) above, wherein the arithmetic device is provided in at least one of a next generation Node B (gNodeB or gNB) or an AMF (Access and Mobility Management Function).(13) Another aspect of the present invention is a computation method including: an extraction step of extracting a bit string having the same bit length as the bit length of the input key by extracting a bit string corresponding to the bit length of the input key from a bit string included in the common key, when the bit length of the common key assigned for use in communication between a terminal device and a network is longer than the bit length of an input key used in a predetermined algorithm; an encryption step of generating a ciphertext by performing encryption processing on a predetermined plaintext agreed upon between the terminal device and the network, using the bit string extracted by the extraction step as a key; and a key generation step of repeating the encryption step again, when the bit length of the ciphertext generated by the encryption step is shorter than an integer multiple of the bit length of the input key, until the total bit length of the generated ciphertexts becomes longer than an integer multiple of the bit length of the input key, dividing the bit string obtained by the repeated processing into units of the bit length of the input key, and generating a key having the same bit length as the bit length of the input key based on the multiple bit strings obtained by the division.(14) Also, one aspect of the present invention is a program that causes a computer to execute the following steps: extracting a bit string having the same bit length as the bit length of the input key by extracting a bit string corresponding to the bit length of the input key from a bit string contained in the common key, when the bit length of the common key assigned for use in communication between a terminal device and a network is longer than the bit length of an input key used in a predetermined algorithm; encrypting the bit string extracted in the extraction step as a key to generate a ciphertext by performing encryption processing on a predetermined plaintext agreed upon between the terminal device and the network; and repeating the encryption step again, when the bit length of the ciphertext generated in the encryption step is shorter than an integer multiple of the bit length of the input key, until the total bit length of the generated ciphertexts becomes longer than an integer multiple of the bit length of the input key, dividing the bit string obtained by the repeated processing into bits of the input key, and generating a key having the same bit length as the input key based on the multiple bit strings obtained by the division.

[0007] According to the present invention, it is possible to provide a computing device, a terminal device, a network, a computing method, and a program that are capable of compressing the bit length of a given key and generating a key equal to the key size used in a cryptographic algorithm.

[0008] FIG. 1 is a diagram showing a general architecture of a wireless system according to an embodiment; FIG. 2 is a block diagram showing a schematic representation of a wireless system according to the present embodiment; FIG. 3 is a diagram for explaining processing when a 128-bit key is given to a wireless system according to the present embodiment, and processing when a 256-bit key is given to the wireless system according to the present embodiment; FIG. 4 is a flowchart showing a series of steps of a calculation method according to the present embodiment; and FIG. 5 is a block diagram showing an example of the internal configuration of a network or a terminal device according to the present embodiment.

[0009] [Embodiments] Preferred embodiments of a computing device, a terminal device, a network, a computing method, and a program according to aspects of the present invention are described in detail below with reference to the accompanying drawings. Note that the aspects of the present invention are not limited to these embodiments and include various modifications or improvements. In other words, the components described below include those that would be easily conceivable to a person skilled in the art or that are substantially identical, and the components described below can be combined as appropriate. Furthermore, various omissions, substitutions, or modifications of the components can be made without departing from the spirit of the present invention. Furthermore, in the drawings below, the scale and number of components may differ from the scale and number of the actual structures to make each configuration easier to understand.

[0010] In the following description, for convenience of explanation, terms and names defined in the 3GPP (registered trademark) LTE (3rd Generation Partnership Project Long Term Evolution) standard may be used. However, the present embodiment is not limited by such terms and names and may be applied to systems based on other standards.

[0011] 1 is a diagram showing a schematic architecture of a wireless system according to one embodiment. The wireless system 1 shown in the figure has, as its functional configuration, a control plane (C-Plane), which is a function for controlling communication, and a user plane (U-Plane), which is a function for realizing user communication. For the sake of simplicity, the figure shows the basic architecture used in a fifth-generation mobile communication system (5th Generation; 5G). However, the wireless system 1 to which this embodiment is applied is not limited to an example applied to 5G, and can be widely applied to other systems.

[0012] In the following description, configurations other than UE (User Equipment) may be referred to as a network. The network includes an access stratum and a non-access stratum. The access stratum includes at least a base station, and the non-access stratum includes at least an AMF (Access and Mobility Management Function). As shown in the figure, the UE and the AMF cooperate with each other via the N1 interface. In the following description, the base station and the AMF may be referred to as a higher-level concept and simply referred to as a network.

[0013] 2 is a block diagram that schematically illustrates a part of the configuration of a wireless system 1. The wireless system 1 has a network 30 and terminal devices 50. The diagram illustrates, as an example, one network and multiple terminal devices 50. Specifically, as an example of the multiple terminal devices 50, terminal device 50-1, terminal device 50-2, ..., and terminal device 50-m (m is a natural number greater than or equal to 1) are illustrated.

[0014] The network 30 communicates with the terminal device 50. The network 30 includes at least a base station. The base station may include functions of an O-RU (Radio Unit), an O-DU (Distributed Unit), and an O-CU (Central Unit), as defined in the specifications of an O-RAN (Open-RAN).

[0015] The base station may also be referred to as a next generation Node B (gNodeB or gNB), en-gNB, Next Generation-Radio Access Network (NG-RAN) node, eNB, low-power node, CU, DU, RU, gNB-DU, Remote Radio Head (RRH), Integrated Access and Backhaul / Backhauling (IAB) node, etc. The base station is not limited to one node, but may be composed of multiple nodes (for example, a combination of a lower node such as an RU or DU and an upper node such as a CU).

[0016] The terminal device 50 is used by a user. Specific examples of the terminal device 50 include a smartphone, a tablet terminal device, a wearable device, etc. The terminal device 50 may also be called a user device, a UE, or the like.

[0017] Here, the network 30 and the terminal device 50 each include a computing device 10. The computing device 10 includes at least a processor and a memory as hardware configurations. The computing device 10 may be configured such that its functions are realized by causing a computer to execute a program. The computing device 10 performs calculations to expand or compress the number of bits of a key used for encryption or decryption. The configurations of the computing devices 10 included in the network 30 and the terminal device 50 may be the same or different. However, it is assumed that at least a portion of the configurations of the computing devices 10 included in the network 30 and the terminal device 50 are the same.

[0018] The location where the arithmetic device 10 is provided in the network 30 is arbitrary. For example, the arithmetic device 10 may be provided in a gNodeB or an AMF. It can also be said that the arithmetic device 10 is provided in at least one of the gNodeB and the AMF in the network 30.

[0019] 3 is a diagram illustrating processing when a 128-bit key is assigned to the wireless system according to this embodiment and processing when a 256-bit key is assigned. Here, the wireless system 1 may be assigned a 128-bit key or a 256-bit key. Whether to perform encrypted communication using a 128-bit key or a 256-bit key is determined at the start of communication. Specifically, the network 30 and the terminal device 50 negotiate at the start of communication to determine the algorithm to be used. If the negotiation determines that 128 bits will be used and a 128-bit key is assigned, the network 30 and the terminal device 50 can perform encrypted communication with each other using the 128-bit key as is. However, if a 256-bit key is assigned, the 256-bit key must first be compressed to 128 bits and then the compressed 128-bit key must be used to perform encrypted communication with each other.

[0020] 3A shows an example in which a 128-bit key is provided. In this case, the network 30 and the terminal device 50 can perform encrypted communication with each other using the 128-bit key.

[0021] 3B shows an example in which a 256-bit key is provided. In this case, both the network 30 and the terminal device 50 need to compress the 256-bit key to 128 bits. The network 30 and the terminal device 50 use the key obtained as a result of the compression to perform encrypted communication with each other.

[0022] [Specific Example of Key Compression Method] Fig. 4 is a flowchart showing a series of steps in the calculation method according to this embodiment. A specific example of the key compression method will be described with reference to this figure. Note that, in the above example, an example of compressing a 256-bit key to 128 bits has been described, but the number of bits of the key targeted by the key compression method according to this embodiment is not limited to this example. In the following description, the number of bits of the key will be generalized.

[0023] Assume that a common key K1 has been generated between the terminal device 50 and the network 30 as a key to be used for encryption. The common key K1 can also be said to be a key assigned for use in communication between the terminal device 50 and the network 30. Also, assume that algorithm E has been selected as the encryption method to be used between the terminal device 50 and the network 30. The input key for algorithm E is referred to as input key K2. The input key K2 can also be said to be a key used in the predetermined algorithm E. The above-mentioned arithmetic device 10 generates the input key K2 by compressing the common key K1. The terminal device 50 and the network 30, which communicate information with each other, generate the same input key K2 by compressing the same common key K1.

[0024] (Step S11) First, the calculation device 10 compares the bit lengths of the common key K1 and the input key K2. When the bit length of the common key K1 is |K1| and the bit length of the input key K2 is |K2|, if |K1|>|K2| (i.e., step S11; YES), the calculation device 10 proceeds to step S12 to generate the input key K2 from the common key K1, and continues the subsequent processing. If |K1|>|K2| is not true (i.e., step S11; NO), the calculation device 10 does not need to perform key compression processing, and therefore ends the processing.

[0025] (Step S12) If the bit length of the common key K1 (e.g., 256 bits) is longer than the bit length of the input key K2 (e.g., 128 bits), the calculation device 10 extracts a bit string from the bit string of the common key K1 that corresponds to the bit length of the input key K2. This step may also be referred to as an extraction step. By performing the extraction step, a bit string having the same bit length as the bit length of the input key K2 is extracted. Specifically, in this extraction step, a bit string that corresponds to the bit length of the input key K2 may be extracted from the beginning of the bit string of the common key K1. In other words, the first bit of the common key K1 may be extracted so that |K2| = |K1a|.

[0026] (Step S13) Next, the calculation device 10 generates ciphertext Ci by performing encryption processing on plaintext m using the bit string extracted in the extraction step as a key. Plaintext m is a predetermined plaintext agreed upon in advance between the terminal device 50 and the network 30. The bit length of plaintext m is preferably the same as or shorter than the bit length of input key K2. The process performed in this step may also be referred to as an encryption step. In the encryption step, ciphertext Ci is generated based on plaintext m and key K1a. Here, i is the number of times the encryption step has been performed, and is a natural number equal to or greater than 1. For example, if the first encryption step generates ciphertext Ci, １ The second encryption step yields the ciphertext C ２ Specifically, the ciphertext C １ can be expressed as the following equation (1).

[0027]

[0028] Here, it is preferable that the bit length of the predetermined plaintext m used in the encryption step is the same (e.g., 128 bits or 64 bits) as the value obtained by dividing the bit length of the input key K2 (e.g., 128 bits) by a natural number n equal to or greater than 1. By doing so, it is possible to omit the padding step in step S18, which will be described later. By increasing n (by shortening the bit length of the plaintext m), the number of encryption steps can be increased, resulting in stronger encryption, but this also means that the processing load increases.

[0029] The plaintext m used for encryption only needs to be agreed upon in advance between the terminal device 50 and the network 30, and may be different each time the encryption process is repeated. In other words, the plaintext m may be different depending on the number of iterations (the above-mentioned i). Also, different plaintext m may be used depending on time. It can also be said that the plaintext m is a variable that varies depending on time.

[0030] Note that known techniques can be applied as an example of a specific encryption process performed in the encryption step. Specific examples of encryption processes include the Advanced Encryption Standard (AES) method and stream encryption. A more specific example of a stream encryption method is Snow-3G (with ZUC as an option).

[0031] (Step S14) Here, the bit length of the ciphertext generated by the encryption step varies depending on the bit length of the plaintext m. The encryption step is preferably repeated, for example, until the entire common key K1 is used. If the encryption step has not been repeated until the entire common key K1 is used (i.e., step S14; NO), the process returns to step S13, and the encryption step is repeated. If the encryption step has been repeated until the entire common key K1 is used (i.e., step S14; YES), the process proceeds to step S15.

[0032] Here, by using the entire common key K1, a stronger encryption can be achieved. Conversely, if the entire common key K1 is not used, for example, it may not be possible to use a characteristic pattern or the like that exists in the unused area. However, this embodiment is not limited to this example, and the encryption process can be performed using any part of the common key K1. In other words, in this embodiment, it is not necessarily necessary to repeat the process until the entire common key K1 is used.

[0033] In this embodiment, it is preferable that at least a part of the common key K1 is used, and the bit length of the generated ciphertext is longer than the bit length obtained by integrally multiples of the bit length of the input key K2. In other words, if the bit length of the ciphertext generated by the encryption process is shorter than the bit length obtained by integrally multiples of the bit length of the input key K2, the encryption process can be repeated again. As a result, the process is repeated until the bit length obtained by adding up (concatenating) the generated ciphertexts becomes longer than the bit length obtained by integrally multiples of the bit length of the input key K2. For example, the ciphertext C obtained by the second encryption process is ２ can be expressed as the following equation (2).

[0034]

[0035] (Step S15) By repeatedly performing the encryption process, ciphertexts C1, C2, ..., Cn are obtained. The calculation device 10 concatenates these ciphertexts to obtain ciphertext C. For example, the ciphertext C obtained as a result of the concatenation can be expressed as the following formula (3).

[0036]

[0037] Here, it is preferable that the number of bits of the ciphertext C is longer than the number of bits of the input key K2. Specifically, it is preferable that the number of bits of the ciphertext C is an integer multiple of the number of bits of the input key K2.

[0038] (Step S16) Next, the calculation device 10 divides the concatenated bit string into blocks of 128 bits each, where the number of bits in the input key K2 is 128. For example, if the number of bits in the input key K2 is 128 bits, the concatenated bit string is divided into blocks of 128 bits each. In other words, the bit string obtained by the repeated processing is divided into blocks of the bit length of the input key K2. The encryption process is repeated n times, where the bit length of the input key K2 is divided by the bit length of the plaintext m, to generate a key having a bit length that is an integer multiple of the bit length of the input key K2 (for example, 512 bits).

[0039] (Step S17) Here, the result of dividing the concatenated bit string may or may not be exactly the number of bits of the input key K2. For example, if the input key K2 has a bit length of 128 bits and the concatenated bit string has a bit length of 512 bits, dividing the 512-bit bit string into 128-bit blocks will result in exactly four blocks (i.e., exactly the number of bits of the input key K2). If the result of dividing the concatenated bit string is exactly the number of bits of the input key K2 (i.e., step S17; YES), the process proceeds to step S19. If the result of dividing the concatenated bit string is not exactly the number of bits of the input key K2 (i.e., step S17; NO), the process proceeds to step S18.

[0040] (Step S18) If the result of dividing the concatenated bit string does not exactly match the number of bits of the input key K2, the number of bits is expanded by padding. That is, if the number of bits of the last divided block is not the number of bits of the input key K2, the number of bits is increased by padding until it matches the number of bits of the input key K2. In other words, if the result of dividing the input key K2 into each bit length is such that the divided bit string is not an integer multiple of the number of bits of the input key K2, the number of bits can be increased by padding until the divided bit string is an integer multiple of the number of bits of the input key K2.

[0041] (Step S19) Finally, a key having the same bit length as the input key K2 is generated based on the multiple blocks (bit strings) obtained by division. For example, a reduced input key may be obtained by calculating the exclusive OR of each bit string. The equation for obtaining the input key K2 by calculating the exclusive OR can be expressed, for example, as the following equation (4).

[0042]

[0043] The method of calculating each bit string is not limited to exclusive OR. According to this embodiment, other calculation methods can be applied instead of exclusive OR.

[0044] Steps S14 to S19 may be referred to as a key generation process.

[0045] FIG. 5 is a block diagram showing an example of the internal configuration of a network or a terminal device according to this embodiment. At least some of the functions of the network 30 or the terminal device 50 can be implemented using a computer. As shown in the figure, the computer includes a central processing unit (processor) 901, a RAM 902, an input / output port 903, input / output devices 904 and 905, and a bus 906. The computer itself can be implemented using existing technology. The central processing unit 901 executes instructions contained in a program read from the RAM 902 or the like. In accordance with each instruction, the central processing unit 901 writes data to the RAM 902, reads data from the RAM 902, and performs arithmetic and logical operations. The RAM 902 stores data and programs. Each element included in the RAM 902 has an address and can be accessed using the address. RAM stands for "random access memory." The input / output port 903 is a port through which the central processing unit 901 exchanges data with external input / output devices. The input / output devices 904 and 905 are input / output devices. The input / output devices 904 and 905 exchange data with the central processing unit 901 via the input / output port 903. The bus 906 is a common communication path used within the computer. For example, the central processing unit 901 reads and writes data from the RAM 902 via the bus 906. Also, for example, the central processing unit 901 accesses the input / output port via the bus 906. Furthermore, all or part of the functional units provided in the network 30 or the terminal device 50 may be realized using hardware such as an ASIC, a PLD, or an FPGA. Furthermore, all or part of the functional units may be realized by a combination of software and hardware.

[0046] [Summary of the embodiment] According to the embodiment described above, the arithmetic device 10 causes a computer including at least a processor and a memory to execute an extraction step, an encryption step, and a key generation step. In the extraction step, when the bit length of a common key K1 assigned for use in communication between the terminal device 50 and the network 30 is longer than the bit length of an input key K2 used in a predetermined algorithm E, a bit string having the same bit length as the input key K2 is extracted from the bit string of the common key K1, corresponding to the bit length of the input key K2. In the encryption step, a ciphertext Ci is generated by performing encryption processing on a predetermined plaintext m agreed upon in advance between the terminal device 50 and the network 30 using the bit string extracted in the extraction step as a key. In the key generation step, if the bit length of the ciphertext generated in the encryption step is shorter than an integer multiple of the bit length of input key K2, the encryption step is repeated until the total bit length of the generated ciphertexts becomes longer than an integer multiple of the bit length of input key K2, the bit string obtained by the repeated processing is divided into bits of input key K2, and a key having the same bit length as input key K2 is generated based on the multiple bit strings obtained by the division. By adopting such a configuration, it is possible to compress the bit length of a given key and generate a key equal to the size of the key used in the encryption algorithm.

[0047] Furthermore, the above-described embodiment makes it possible to contribute to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), which is to "build resilient infrastructure, promote sustainable industrialization, and foster innovation," by, for example, "compressing the bit length of a given key and generating a key equal to the key size used in the encryption algorithm."

[0048] Although an embodiment of the present invention has been described in detail above with reference to the drawings, the specific configuration is not limited to this embodiment, and design changes and the like are also included within the scope that does not deviate from the gist of the present invention.

[0049] Furthermore, a computer program for implementing the functions of each of the above-described devices may be recorded on a computer-readable recording medium, and the program may be read and executed by a computer system. The term "computer system" may also include hardware such as an OS and peripheral devices. The term "computer-readable recording medium" refers to a flexible disk, a magneto-optical disk, a ROM, a writable nonvolatile memory such as a flash memory, a portable medium such as a DVD (Digital Versatile Disc), or a storage device such as a hard disk built into a computer system.

[0050] Furthermore, the term "computer-readable recording medium" also includes a storage medium that stores a program for a certain period of time, such as a volatile memory (e.g., DRAM (Dynamic Random Access Memory)) within a computer system that serves as a server or client when the program is transmitted via a network such as the Internet or a communication line such as a telephone line. The program may also be transmitted from a computer system that stores the program in a storage device or the like to another computer system via a transmission medium or by transmission waves within the transmission medium. Here, the "transmission medium" that transmits the program refers to a medium that has the function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. The program may also be a program that realizes part of the aforementioned functions. Furthermore, the program may be a so-called differential file (differential program) that can realize the aforementioned functions in combination with a program already recorded in the computer system.

[0051] According to the present invention, it is possible to compress the bit length of a given key and generate a key having the same size as the key used in the encryption algorithm.

[0052] 1...wireless system, 10...arithmetic unit, 30...network, 50...terminal device, K1...common key, E...algorithm, K2...input key, m...plaintext

Claims

1. A computing device that causes a computer having at least a processor and memory to execute the following steps: an extraction step of extracting a bit string having the same bit length as the bit length of the input key by extracting a bit string corresponding to the bit length of the input key from the bit string of the common key when the bit length of the common key assigned for use in communications between a terminal device and a network is longer than the bit length of an input key used in a predetermined algorithm; an encryption step of generating ciphertext by performing encryption processing on a predetermined plaintext agreed upon between the terminal device and the network using the bit string extracted in the extraction step as a key; and a key generation step of repeating the encryption step again when the bit length of the ciphertext generated in the encryption step is shorter than an integer multiple of the bit length of the input key, continuing the iterative processing until the total bit length of the generated ciphertexts becomes longer than an integer multiple of the bit length of the input key, dividing the bit string obtained by the iterative processing into bits of the input key, and generating a key having the same bit length as the input key based on the multiple bit strings obtained by the division.

2. The computing device according to claim 1, wherein the extraction step extracts, from the beginning of the bit string contained in the common key, a bit string corresponding to the bit length of the input key.

3. The computing device according to claim 1, wherein the key generation step generates a key having the same bit length as the input key by calculating an exclusive OR of multiple bit strings obtained by division.

4. The arithmetic device according to claim 1, wherein, in the key generation step, if the divided bit strings are not an integer multiple of the number of bits of the input key as a result of dividing the input key by bit length, the number of bits is increased by padding so that the divided bit strings are an integer multiple of the number of bits of the input key.

5. The computing device according to claim 1, wherein the predetermined plaintexts used in the encryption step are different depending on the number of iterations performed in the key generation step.

6. The computing device according to claim 1, wherein the predetermined plaintext used in the encryption step is a variable depending on time that is agreed upon in advance between the terminal device and the network.

7. The arithmetic device according to claim 1, wherein the bit length of the predetermined plaintext used in the encryption step is the same as the value obtained by dividing the bit length of the input key by n, a natural number greater than or equal to 1, and wherein the key generation step generates a key having a bit length that is an integer multiple of the bit length of the input key by repeating the encryption step n times.

8. The arithmetic device according to claim 1, wherein the encryption step generates ciphertext using the Advanced Encryption Standard (AES) method or a stream cipher method.

9. The arithmetic device according to claim 1, wherein the common key has a bit length of 256 bits and the input key has a bit length of 128 bits.

10. A terminal device comprising a computing device according to any one of claims 1 to 9.

11. A network comprising a computing device according to any one of claims 1 to 9.

12. The network of claim 11, wherein the computing device is provided in at least one of a next generation Node B (gNodeB or gNB) or an Access and Mobility Management Function (AMF).

13. A calculation method comprising: an extraction step of extracting a bit string having the same bit length as the bit length of the input key by extracting a bit string corresponding to the bit length of the input key from the bit string of the common key when the bit length of the common key assigned for use in communications between a terminal device and a network is longer than the bit length of an input key used in a predetermined algorithm; an encryption step of generating ciphertext by performing encryption processing of a predetermined plaintext agreed upon between the terminal device and the network using the bit string extracted in the extraction step as a key; and a key generation step of repeating the encryption step again when the bit length of the ciphertext generated in the encryption step is shorter than an integer multiple of the bit length of the input key, continuing the iterative processing until the total bit length of the generated ciphertexts becomes longer than an integer multiple of the bit length of the input key, dividing the bit string obtained by the iterative processing into units of the bit length of the input key, and generating a key having the same bit length as the input key based on the multiple bit strings obtained by the division.

14. A program causing a computer to execute the following steps: an extraction step for extracting a bit string having the same bit length as the bit length of the input key by extracting a bit string corresponding to the bit length of the input key from the bit string contained in the common key, when the bit length of the common key assigned for use in communications between a terminal device and a network is longer than the bit length of an input key used in a predetermined algorithm; an encryption step for generating ciphertext by performing encryption processing on a predetermined plaintext agreed upon between the terminal device and the network, using the bit string extracted in the extraction step as a key; and a key generation step for repeating the encryption step again, when the bit length of the ciphertext generated in the encryption step is shorter than an integer multiple of the bit length of the input key, until the total bit length of the generated ciphertexts becomes longer than an integer multiple of the bit length of the input key, dividing the bit string obtained by the repeated processing into bits of the input key, and generating a key having the same bit length as the input key based on the multiple bit strings obtained by the division.

Images