Communication system, communication method, and program

Abstract

Provided is a communication system capable of verifying, before using a common key, both the identity of the key and the appropriateness of processing. The communication system includes a transmission device, a verification device, and a receiving device. The transmission device includes: an evidence generation unit that generates key-ID evidence which is an attestation report corresponding to a key exchanging and sharing scheme for a key associated with a key-ID, and that executes, with respect to the verification device, a registration request for a reference value corresponding to the key-ID evidence; and an encryption communication processing unit which transmits the key-ID and the key-ID evidence to the receiving device. The receiving device includes: an evidence generation unit that generates key-ID reference evidence which is an attestation report corresponding to said key exchanging and sharing scheme for the key associated with the key-ID shared with the transmission device, and that executes, with respect to the verification device, a registration request for a reference value corresponding to the key-ID reference evidence; and an encryption communication processing unit which transmits the key-ID reference evidence to the transmission device.

Description

Communication system, communication method, program

[0001] The present disclosure relates to a communication system, a communication method, and a program for performing encrypted communication or encrypted message communication using a common key.

[0002] In a system that performs encrypted communication or encrypted message communication using a common key shared by utilizing a key sharing function based on a key encapsulation mechanism (Key Encryption Mechanism: KEM) using a public key or a key distribution function that shares a common key using the ID of the key such as quantum key distribution (Quantum Key Distribution: QKD, Non-Patent Document 1), there is an increasing need to address unauthorized access to confidential information such as unauthorized use of encryption keys and decryption of encrypted data, triggered by an attacker's seizure of administrative authority or unauthorized access by a platform provider.

[0003] Quantum Key Distribution (QKD) ETSI Industry Specification Group (ISG), "ETSI GS QKD 014 V1.1.1 (2019-02) Quantum Key Distribution (QKD); Protocol and data format of REST-based key delivery API", [online]、[Retrieved on February 13, 2025]、Internet <URL: https: / / www.etsi.org / deliver / etsi_gs / QKD / 001_099 / 014 / 01.01.01_60 / gs_QKD014v010101p.pdf>

[0004] Since the meanings of "being able to share the same key" (key identity) and "being able to share the same key by the assumed process" (appropriateness of the process) are different, from a security perspective, it is an important issue to realize functions that can verify each of them.

[0005] Note: In the translation of the date in the reference [Retrieved on February 13, 2025], it is assumed that the original "令和7年2月13日" is February 13, 2025 in the Gregorian calendar. If there is a specific conversion rule in the context, it should be adjusted accordingly.KEM allows for indirect verification of key identity based on the transmitted and received data and processing sequences directly exchanged with the other party. However, due to programming errors, configuration errors, etc., it was possible that the same key was not being shared, and there were cases where key identity could not be determined before using the shared key.

[0006] Furthermore, if QKD or both the sender and receiver bring their own keys in advance, current standards cannot verify the identity of the keys and the appropriateness of the processing before using the shared key.

[0007] Furthermore, while AttestedTLS has a mechanism for attesting to the public key of the party being used, and can verify the appropriateness of the key owned by the other party, it does not have an attestation function for shared keys, and therefore cannot verify the identity of the key or the appropriateness of the processing.

[0008] Therefore, this disclosure aims to provide a communication system that can verify both the identity of the key and the appropriateness of the processing before using the shared key.

[0009] The communication system described herein includes a transmitting device, a verification device, and a receiving device.

[0010] The transmitting device includes an evidence generation unit and an encrypted communication processing unit, and the receiving device includes an evidence generation unit and an encrypted communication processing unit.

[0011] The evidence generation unit of the transmitting device generates key ID evidence, which is an attestation report corresponding to the key exchange / sharing method for the key associated with the key ID, and executes a registration request for the reference value corresponding to the key ID evidence to the verification device.

[0012] The encryption communication processing unit of the transmitting device sends the key ID and key ID evidence to the receiving device.

[0013] The evidence generation unit of the receiving device generates key ID reference evidence, which is an attestation report corresponding to the key exchange / sharing method for keys linked to the key ID shared with the transmitting device, and executes a registration request for the reference value corresponding to the key ID reference evidence to the verification device.

[0014] The encrypted communication processing unit of the receiving device sends key ID reference evidence to the transmitting device.

[0015] According to the communication system described herein, both the identity of the key and the appropriateness of the processing can be verified before using the shared key.

[0016] Block diagram showing the device configuration and functional configuration of the communication system of Example 1. Block diagram showing the functional configuration of the application section of the transmitting device. Block diagram showing the functional configuration of the encrypted communication processing section of the transmitting device. Block diagram showing the functional configuration of the key exchange / sharing section of the transmitting device. Block diagram showing the functional configuration of the verification section of the transmitting device. Block diagram showing the functional configuration of the evidence generation section of the transmitting device. Block diagram showing the functional configuration of the application section of the receiving device. Block diagram showing the functional configuration of the encrypted communication processing section of the receiving device. Block diagram showing the functional configuration of the key exchange / sharing section of the receiving device. Block diagram showing the functional configuration of the verification section of the receiving device. Block diagram showing the functional configuration of the evidence generation section of the receiving device. First sequence diagram showing the operation of the communication system of Example 1. Second sequence diagram showing the operation of the communication system of Example 1. Block diagram showing the device configuration of the communication system of Example 2. Block diagram showing the functional configuration of the transmitting application server of Example 2. Block diagram showing the functional configuration of the transmitting key server of Example 2. Block diagram showing the functional configuration of the verification device of Example 2. Block diagram showing the functional configuration of the receiving key server of Example 2. Block diagram showing the functional configuration of the receiving application server of Example 2. A diagram illustrating an example of a computer's functional configuration.

[0017] The embodiments of this disclosure will be described in detail below. Components having the same function will be numbered the same, and redundant explanations will be omitted.

[0018] The communication system of Example 1 is described below. Similar to AttestedTLS, the communication system of this example performs key exchange, sharing, and cryptographic processing within an isolated execution environment, and uses a platform attenuation token to verify that the processing is taking place within the isolated execution environment, as well as an attenuation token for the public key used with KEM.

[0019] Platform attestation tokens, attestation tokens, and the evidence described later are signed using a signature key specific to the isolated execution environment, such as a public key pair signature key that is protected by hardware-specific features of the execution environment and is difficult to falsify. When a verification device performs verification, it can verify using the signature verification key that the information contained in each token is information generated in the isolated execution environment.

[0020] Furthermore, the communication system of this embodiment introduces an attestation token for a shared key and a key ID that identifies it, using a Key Function Delimiter (KDF).

[0021] Furthermore, the communication system of this embodiment is configured to verify both the identity of the key and the appropriateness of the processing by combining information on the platform attestation, the generated public key and symmetric key attestations, and the order of the key derivation process and the input / output information attestations used therein as a reference value (hereinafter also referred to as the reference value) and evidence.

[0022] Furthermore, the communication system in this embodiment acquires attestation reports (evidence) corresponding to each key exchange / sharing method for keys associated with a key ID. The verification procedure for KEM differs from that for QKD, Pre-share, and Hybrid. This will be described in detail in Embodiment 2.

[0023] By using the key ID (identification information) as a basis, separating the information and procedures necessary for verifying key identity and processing appropriateness, and finally combining them into information and processing sequences, it is possible to create a configuration that uses the same functionality regardless of the key sharing method, such as key sharing by KEM, key sharing by QKD, or key sharing by pre-configuration.

[0024] The device configuration and functional configuration of the communication system 1000 of this embodiment will be described below with reference to Figure 1. As shown in the figure, the communication system 1000 of this embodiment has a configuration that includes a transmitting device 1 (abbreviated as A), a verification device 2 (Verifier, abbreviated as VER), and a receiving device 3 (abbreviated as B). The transmitting device 1 has a configuration that includes a data storage unit 10, an application unit 11 (abbreviated as APP), an encrypted communication processing unit 12 (abbreviated as ENC), a key exchange / sharing unit 13 (abbreviated as KEX), a verification unit 14 (abbreviated as V), and an evidence generation unit 15 (abbreviated as ATT).

[0025] The verification device 2 includes a data storage unit 20, a reference value registration unit 21, and a verification unit 22. Although not shown in the diagram, the reference value registration unit 21 and the verification unit 22 each include a data transmission / reception unit.

[0026] The receiving device 3 includes a data storage unit 30, an application unit 31 (abbreviated as APP), an encrypted communication processing unit 32 (abbreviated as ENC), a key exchange / sharing unit 33 (abbreviated as KEX), a verification unit 34 (abbreviated as V), and an evidence generation unit 35 (abbreviated as ATT).

[0027] Both the transmitting device 1 and the receiving device 3 are assumed to be in their own isolated execution environments, and the dashed lines in the figure show an example of division into functional block units within the isolated execution environment.

[0028] Furthermore, it is preferable that the roles of the transmitter 1 and the receiver 3 be switched as appropriate depending on which one acts as the transmitter and which as the receiver. In this case, it is preferable to implement / install the functions of both the transmitter 1 and the receiver 3 into a general-purpose device. Examples of general-purpose devices that function as both the transmitter 1 and the receiver 3 include PCs and smartphones.

[0029] Furthermore, as shown in Figures 2-6, the application unit 11 of the transmitting device 1 can be configured to include a data transmission / reception unit 110 and a communication request unit 111; the encrypted communication processing unit 12 of the same device can be configured to include a data transmission / reception unit 120, an authentication unit 121, a method specification unit 122, a key acquisition request unit 123, a notification unit 124, a verification request unit 125, and an establishment notification unit 126; the key exchange / sharing unit 13 of the same device can be configured to include a data transmission / reception unit 130, a key exchange unit 131, and a key status registration unit 132; the verification unit 14 of the same device can be configured to include a data transmission / reception unit 140 and a verification request unit 141; and the evidence generation unit 15 of the same device can be configured to include a data transmission / reception unit 150, an evidence generation unit 151, and a registration request unit 152.

[0030] Furthermore, as shown in Figures 7-11, the application unit 31 of the receiving device 3 can be configured to include a data transmission / reception unit 310, the encrypted communication processing unit 32 of the same device can be configured to include a data transmission / reception unit 320, a communication request unit 321, a method specification unit 322, a key request unit 323, a verification request unit 324, a key acquisition notification unit 325, and an establishment notification unit 326, the key exchange / sharing unit 33 of the same device can be configured to include a data transmission / reception unit 330, a key status registration unit 331, and an update registration unit 332, the verification unit 34 of the same device can be configured to include a data transmission / reception unit 340 and a verification request unit 341, and the evidence generation unit 35 of the same device can be configured to include a data transmission / reception unit 350, a first registration request unit 351, an evidence generation unit 352, and a second registration request unit 353.

[0031] The following describes the operation of the communication system in this embodiment, from key exchange to the establishment of an encrypted communication channel, with reference to Figures 12 and 13. Note that the transmission and reception of data within and outside the device associated with each operation (mainly indicated by arrows in Figures 12 and 13) are performed by the data transmission and reception units included in each configuration requirement, and their descriptions are omitted as appropriate.

[0032] As shown in Figure 12, the communication request unit 111 of the application unit 11 of the transmitting device 1 executes a communication request to the encrypted communication processing unit 12 of the transmitting device 1 (S111).

[0033] The authentication unit 121 of the encrypted communication processing unit 12 of the transmitting device 1 performs authentication for the encrypted communication processing unit 32 of the receiving device 3 (S121).

[0034] The communication request unit 321 of the encrypted communication processing unit 32 of the receiving device 3 executes a communication request to the application unit 31 of the receiving device 3 (S321).

[0035] The method specification unit 122 of the encryption communication processing unit 12 of the transmitting device 1 specifies the key exchange and sharing method to the encryption communication processing unit 32 of the receiving device 3 (S122).

[0036] The method specification unit 322 of the encryption communication processing unit 32 of the receiving device 3 specifies the key exchange / sharing partner and method to the key exchange / sharing unit 33 of the receiving device 3 (S322).

[0037] The key acquisition request unit 123 of the encryption communication processing unit 12 of the transmitting device 1 executes a key acquisition request to the key exchange / sharing unit 13, specifying the key exchange / sharing partner and method (S123).

[0038] The key exchange unit 131 of the key exchange / sharing unit 13 of the transmitting device 1 performs key exchange with the key exchange / sharing unit 33 of the receiving device 3 based on the specified partner and method (S131).

[0039] The key status registration unit 132 of the key exchange / sharing unit 13 of the transmitting device 1 requests the evidence generation unit 15 of the transmitting device 1 to register the key status (S132).

[0040] Similarly, the key status registration unit 331 of the key exchange / sharing unit 33 of the receiving device 3 requests the evidence generation unit 35 of the receiving device 3 to register the key status (S331).

[0041] The evidence generation unit 151 of the evidence generation unit 15 of the transmitting device 1 generates key ID evidence, which is evidence corresponding to the key ID (S151). As mentioned above, the key ID evidence is information about the key that was shared in the key exchange / sharing unit and is linked to the key ID, and includes an attestation report corresponding to the key exchange / sharing method.

[0042] The evidence generation unit 15 notifies the generated key ID evidence to the key exchange and sharing unit 13. The key exchange and sharing unit 13 notifies the encryption communication processing unit 12 of its own key, the corresponding key ID, and the corresponding key ID evidence.

[0043] The registration request unit 152 of the evidence generation unit 15 of the transmission device 1 executes a registration request for a reference value corresponding to the key ID evidence generated on the transmission side to the verification device 2 (S152).

[0044] As described above, this reference value is generated by combining information regarding platform attestation, attestation of the generated public key and common key, the order of the key derivation process, and attestation of the input / output information used therein.

[0045] It is preferable that the reference value and evidence do not include key information such as a secret key or a common key that must not be leaked to the outside, and include only identification information such as a key ID.

[0046] Similarly, the registration request unit 351 of the reception device 3 executes a registration request for a reference value generated on the reception side to the verification device 2 (S351).

[0047] The reference value registration unit 21 of the verification device 2 stores (registers) the reference value received from the transmission device 1 and the reference value received from the reception device 3 in the data storage unit 20 (S21).

[0048] The notification unit 124 of the encryption communication processing unit 12 of the transmission device 1 transmits (notifies) the key ID corresponding to its own key and the corresponding key ID evidence to the encryption communication processing unit 32 of the reception device 3 (S124).

[0049] The key request unit 323 of the encryption communication processing unit 32 of the reception device 3 executes a key request for requesting a key corresponding to the received key ID to the key exchange and sharing unit 33 of the reception device 3 (S323).

[0050] As shown in FIG. 13, the update registration unit 332 of the key exchange and sharing unit 33 of the reception device 3 requests the evidence generation unit 35 of the reception device 3 to update and register the key state based on the received key ID (S332).

[0051] The evidence generation unit 352 of the evidence generation unit 35 of the receiving device 3 generates evidence based on the key ID received from the transmitting device 1 (S352). As described above, this evidence is linked to the key ID shared with the transmitting device 1 and is information about the key held inside the receiving device 3, and includes an attestation report corresponding to the key exchange / sharing method. This evidence is called key ID reference evidence to distinguish it from the key ID evidence generated on the transmitting device 1 side.

[0052] The evidence generation unit 35 notifies the key exchange / sharing unit 33 of the generated key ID reference evidence. The key exchange / sharing unit 33 notifies the encrypted communication processing unit 32 of its own key and the corresponding key ID reference evidence.

[0053] The registration request unit 353 of the evidence generation unit 35 of the receiving device 3 executes a registration request for the reference value corresponding to the generated key ID reference evidence (S353).

[0054] The reference value registration unit 21 of the verification device 2 stores (registers) the reference value received from the receiving device 3 in the data storage unit 20 (S21).

[0055] The verification request unit 324 of the encrypted communication processing unit 32 of the receiving device 3 executes a verification request to the verification unit 34 of the receiving device 3 (S324).

[0056] The verification request unit 341 of the verification unit 34 of the receiving device 3 executes a verification request to the verification device 2 based on the key ID evidence received from the transmitting device 1 (S341).

[0057] This verification request asks for verification of whether the key exchange / sharing units (13, 33) are properly sharing the key associated with the key ID.

[0058] The verification unit 22 of the verification device 2 performs verification (S22) based on the key ID evidence received from the receiving device 3 and the corresponding reference value registered in the data storage unit 20, and generates a verification result. Specifically, the verification unit 22 of the verification device 2 verifies the appropriateness of the binding state (connection state) between each processing process and the key ID based on the key ID evidence presented by the receiving device 3 and the reference value registered by the transmitting device 1.

[0059] The verification unit 22 transmits the verification result to the verification unit 34 of the receiving device 3. The verification unit 34 notifies the encrypted communication processing unit 32 of the verification result.

[0060] The key acquisition notification unit 325 of the encrypted communication processing unit 32 of the receiving device 3 transmits (notifies) a key acquisition notification including the key ID and key ID reference evidence to the encrypted communication processing unit 12 of the transmitting device 1 (S325).

[0061] The verification request unit 125 of the encrypted communication processing unit 12 of the transmitting device 1 executes a verification request to the verification unit 14 of the transmitting device 1 (S125).

[0062] The verification request unit 141 of the verification unit 14 of the transmitting device 1 executes a verification request to the verification device 2 based on the key ID reference evidence received from the receiving device 3 (S141).

[0063] This verification request asks for verification of whether the key exchange / sharing units (13, 33) are properly sharing the key associated with the key ID.

[0064] The verification unit 22 of the verification device 2 performs verification (S22) based on the key ID reference evidence received from the transmitting device 1 and the corresponding reference value registered in the data storage unit 20, and generates a verification result. Specifically, the verification unit 22 of the verification device 2 verifies the appropriateness of the binding state (connection state) between each processing process and the key ID based on the key ID reference evidence presented by the transmitting device 1 and the reference value registered by the receiving device 3.

[0065] The verification unit 22 transmits the verification result to the verification unit 14 of the transmitting device 1. The verification unit 14 notifies the encrypted communication processing unit 12 of the transmitting device 1 of the verification result.

[0066] If verification requests from both the sender and receiver are successfully completed, it means that a secure channel (encrypted communication path) has been established.

[0067] The establishment notification unit 126 of the transmitting device 1 notifies the application unit 11 of the transmitting device 1 and the encrypted communication processing unit 32 of the receiving device 3 of the establishment of an encrypted communication channel (S126).

[0068] The establishment notification unit 326 of the encrypted communication processing unit 32 of the receiving device 3 notifies the application unit 31 of the receiving device 3 of the establishment of an encrypted communication channel (S326).

[0069] In the following, both application units (11, 31) can perform encrypted communication via an encryption processing process.

[0070] Furthermore, after receiving notification of the establishment of an encrypted communication channel, both application units (11, 31) can verify the evidence of the communication channel establishment via the verification units (14, 34).

[0071] As described above, the communication system 1 of this embodiment allows for the creation of new functions using key ID evidence and key ID reference evidence, and mutual verification, as shown in the processing procedure described above. This enables the key sharing process, particularly the processing process on the other side, and the verification and confirmation of the matching of the shared keys to be performed before the acquired key is used. Compared to conventional key exchange and sharing methods, this improves the reliability of the key sharing function (means), the encrypted communication processing function, and the keys used.

[0072] Furthermore, since the same verification can be applied to different key sharing methods, such as pre-configured key sharing, KEM, QKD, and hybrid methods, it becomes easy to incorporate new key sharing methods.

[0073] As shown in Example 1, in this system, the functions are divided into application function APP, encrypted communication processing function ENC, key exchange / sharing function KEX, evidence generation function (attester function) ATT, verification function V, and verifier function VER. With the above configuration based on key ID, appropriate verification can be performed even in a configuration where encryption processing and key exchange / sharing are separated into different spaces.

[0074] The following describes the communication system of Embodiment 2, which is an example in which the application unit and the encrypted communication processing unit operate in a separate, isolated execution environment from the key exchange and sharing unit.

[0075] As shown in Figure 14, the communication system 2000 of this embodiment includes a transmitting application server 4, a transmitting key server 5, a verification device 6, a receiving key server 7, and a receiving application server 8.

[0076] The transmitting application server 4 corresponds to a device in which some functions of the transmitting device 1 of Embodiment 1 have been separated. As shown in Figure 15, it has a configuration that includes a data storage unit 40, an application unit 11 (APP), an encrypted communication processing unit 12 (ENC), an evidence generation unit 41 (ATT), and a verification unit 42 (V). The application unit 11 (APP) and the encrypted communication processing unit 12 (ENC) perform the same processing as in Embodiment 1.

[0077] The transmitting key server 5 corresponds to a device in which some functions of the transmitting device 1 of Embodiment 1 have been separated. As shown in Figure 16, it has a configuration that includes a data storage unit 50, a key exchange / sharing unit 13 (KEX), an evidence generation unit 51, and a verification unit 52. The key exchange / sharing unit 13 (KEX) performs the same processing as in Embodiment 1.

[0078] Verification device 6 is an extended version of verification device 2 in Example 1, and as shown in Figure 17, it includes a data storage unit 60, a first reference value registration unit 61, a second reference value registration unit 62, a verification unit 63, a third reference value registration unit 64, and a fourth reference value registration unit 65. Although not shown in the figure, the first, second, third, and fourth reference value registration units 61, 62, 64, and 65 and the verification unit 63 each include a data transmission and reception unit.

[0079] The receiving key server 7 corresponds to a device in which some functions of the receiving device 3 of Embodiment 1 have been separated. As shown in Figure 18, it has a configuration that includes a data storage unit 70, a key exchange / sharing unit 33 (KEX), an evidence generation unit 71, and a verification unit 72. The key exchange / sharing unit 33 (KEX) performs the same processing as in Embodiment 1.

[0080] The receiving application server 8 corresponds to a device in which some functions of the receiving device 3 of Embodiment 1 have been separated. As shown in Figure 19, it has a configuration that includes a data storage unit 80, an application unit 31 (APP), an encrypted communication processing unit 32 (ENC), an evidence generation unit 81 (ATT), and a verification unit 82 (V). The application unit 31 (APP) and the encrypted communication processing unit 32 (ENC) perform the same processing as in Embodiment 1.

[0081] In the communication system 2000 of this embodiment, key sharing and encrypted communication processing using the shared key are performed in different isolated execution environments. Therefore, evidence is required for each isolated execution environment in which both functions operate. For this reason, an evidence generation unit and a verification unit are provided in each isolated execution environment, and these are registered as separate reference values ​​in the verification device 6.

[0082] Specifically, the evidence generation unit 41 of the transmitting application server 4 generates evidence regarding APP11 and ENC12 (hereinafter referred to as the first evidence), and executes a request to the verification device 6 to register a reference value corresponding to the first evidence. The first reference value registration unit 61 of the verification device 6 registers the reference values ​​regarding APP11 and ENC12 of the transmitting application server 4. The encrypted communication processing unit 12 of the transmitting application server 4 transmits the first evidence regarding APP11 and ENC12 to the receiving application server 8 (communication path between ENC12 and ENC32).

[0083] Similarly, the evidence generation unit 51 of the transmitting key server 5 generates evidence related to KEX13 (hereinafter referred to as the second evidence) and executes a request to the verification device 6 to register a reference value corresponding to the second evidence. The second reference value registration unit 62 of the verification device 6 registers the reference value related to KEX13 of the transmitting key server 5. The key exchange / sharing unit 13 transmits the second evidence related to KEX13 to the receiving key server 7 (communication path between KEX13 and KEX33).

[0084] Similarly, the evidence generation unit 71 of the receiving key server 7 generates evidence related to KEX33 (hereinafter referred to as the third evidence) and executes a request to the verification device 6 to register a reference value corresponding to the third evidence. The third reference value registration unit 64 of the verification device 6 registers the reference value related to KEX33 of the receiving key server 7. The key exchange / sharing unit 33 transmits the third evidence related to KEX33 to the transmitting key server 5 (KEX13-KEX33 communication path).

[0085] Similarly, the evidence generation unit 81 of the receiving application server 8 generates evidence regarding APP31 and ENC32 (hereinafter referred to as the fourth evidence), and executes a request to the verification device 6 to register a reference value corresponding to the fourth evidence. The fourth reference value registration unit 65 of the verification device 6 registers the reference values ​​regarding APP31 and ENC32 of the receiving application server 8. The encrypted communication processing unit 32 of the receiving application server 8 transmits the fourth evidence regarding APP31 and ENC32 to the transmitting application server 4 (communication path between ENC12 and ENC32).

[0086] Furthermore, during the verification phase, the verification unit 42 of the sending application server 4 issues a verification request to the verification device 6 based on the fourth evidence regarding the appropriateness of the operation of the receiving side's functions, APP31 and ENC32. The verification unit 63 of the verification device 6 then verifies the appropriateness of the operation of APP31 and ENC32 based on the fourth evidence received from the verification unit 42 and the corresponding registered reference values.

[0087] Similarly, the verification unit 52 of the transmitting key server 5 issues a verification request to the verification device 6 based on the third evidence regarding the appropriateness of the operation of KEX33, which is a function of the other party. The verification unit 63 of the verification device 6 verifies the appropriateness of the operation of KEX33 based on the third evidence received from the verification unit 52 and the corresponding registered reference value.

[0088] Similarly, the verification unit 72 of the receiving key server 7 issues a verification request to the verification device 6 based on the second evidence regarding the appropriateness of the operation of KEX13, which is a function of the other party. The verification unit 63 of the verification device 6 verifies the appropriateness of the operation of KEX13 based on the second evidence received from the verification unit 72 and the corresponding registered reference value.

[0089] Similarly, the verification unit 82 of the receiving application server 8 executes a verification request to the verification device 6 based on the first evidence regarding the appropriateness of the operation of the other party's functions, APP11 and ENC12. The verification unit 63 of the verification device 6 verifies the appropriateness of the operation of APP11 and ENC12 based on the first evidence received from the verification unit 82 and the corresponding registered reference value.

[0090] In this way, the appropriateness of the operation of each function of each device and the identity of the key can be verified by using evidence and submitting a verification request to the verification device 6.

[0091] [Modification 1] Using the key ID as a reference, the information and procedures necessary for verifying key identity and processing appropriateness are kept separate. Reference values ​​and evidence corresponding to each key sharing method are generated, and finally, the relevant evidence is combined. This allows the same functionality to be used even if the key sharing method differs, such as key sharing by KEM, key sharing by QKD, or key sharing by pre-configuration.

[0092] This modified example describes a communication system that can verify key identity and the appropriateness of processing even when the key exchange and sharing methods differ.

[0093] If the key exchange / sharing methods differ, the communication system generates evidence according to the following rules.

[0094] General principle: When generating evidence, include information specific to each method. The following is an example.

[0095] - KEM: Generation evidence of the key pair generated for use in KEM - QKD: Identification information when the key is screened and finally determined - Pre-share: Identification information of the key storage function when setting and saving the common key - Hybrid key exchange: Key ID information for each key used in multiple key exchanges According to the communication system of this modified example, the identity of the key and the appropriateness of the processing can be verified even when the key exchange and sharing methods are different.

[0096] Furthermore, the device (terminal) may also be used for using the device, system, or method of disclosure via a network (telecommunication line). The "device (terminal) for use" may be equipped with functions necessary to obtain the effects of implementing the device, system, or method of disclosure (e.g., control functions, decoding functions, restoration functions, input / output functions, etc.).

[0097] [Processors, Programs, Recording Media] The functions realized by the components described herein may be implemented in a circuitry or processing circuitry, including general-purpose processors, application-specific processors, integrated circuits, ASICs (Application Specific Integrated Circuits), CPUs (a Central Processing Unit), conventional circuits, and / or combinations thereof, programmed to realize the functions described herein. A processor includes transistors and other circuits and is considered a circuitry or processing circuitry. A processor may be a programmed processor that executes a program stored in memory.

[0098] In this specification, circuitry, unit, and means are hardware programmed to perform or execute the functions described herein. Such hardware may be any hardware disclosed herein, or any hardware known to be programmed to perform or execute the functions described herein.

[0099] If the hardware is a processor that is considered to be a type of circuitry, then the circuitry, means, or unit is a combination of hardware and software used to constitute the hardware and / or processor.

[0100] The various processes described above can be carried out by loading a program that executes each step of the above method into the recording unit 10020 of the computer 10000 shown in Figure 20, and then causing the control unit 10010, input unit 10030, output unit 10040, display unit 10050, etc. to operate.

[0101] The program describing this process can be recorded on a computer-readable recording medium. Any computer-readable recording medium can be used, such as a magnetic recording device, optical disc, magneto-optical recording medium, or semiconductor memory.

[0102] A program describing this process may be included in a computer program product.

[0103] Furthermore, this program may be distributed, for example, by selling, transferring, or lending portable recording media such as DVDs or CD-ROMs on which the program is recorded. Alternatively, the program may be stored in the storage device of a server computer and distributed by transferring the program from the server computer to other computers via a network.

[0104] A computer executing such a program may, for example, first store the program recorded on a portable storage medium or a program transferred from a server computer in its own storage device. Then, when processing is to be executed, the computer reads the program stored on its own storage medium and executes the processing according to the read program. Alternatively, the computer may directly read the program from the portable storage medium and execute the processing according to that program, or it may sequentially execute the processing according to the received program each time a program is transferred to it from a server computer. Furthermore, the processing may be executed using a so-called ASP (Application Service Provider) type service, where the processing function is realized only by issuing execution instructions and obtaining results, without transferring the program from the server computer to this computer.In addition, the processing may be executed using a so-called SaaS (Software as a Service) type service, where a part of the server computer is made available to the user along with the program. Furthermore, the term "program" in this form includes information used for processing by an electronic computer that is equivalent to a program (data, etc., that is not a direct instruction to the computer but has the property of defining the processing of the computer).

[0105] Furthermore, in this configuration, the device is configured by executing a predetermined program on a computer, but at least a part of these processes may be implemented in hardware.

Claims

1. A communication system comprising a transmitting device, a verification device, and a receiving device, wherein the transmitting device includes an evidence generation unit that generates key ID evidence, which is an attestation report corresponding to a key exchange / sharing method for a key associated with a key ID, and executes a registration request for a reference value corresponding to the key ID evidence to the verification device, and an encrypted communication processing unit that transmits the key ID and the key ID evidence to the receiving device, and the receiving device includes an evidence generation unit that generates key ID reference evidence, which is an attestation report corresponding to a key exchange / sharing method for a key associated with a key ID shared with the transmitting device, and executes a registration request for a reference value corresponding to the key ID reference evidence to the verification device, and an encrypted communication processing unit that transmits the key ID reference evidence to the transmitting device.

2. A communication system according to claim 1, wherein the transmitting device includes a verification unit that executes a verification request to the verification device based on key ID reference evidence received from the receiving device, the receiving device includes a verification unit that executes a verification request to the verification device based on key ID evidence received from the transmitting device, and the verification device performs verification based on the reference value corresponding to the received evidence.

3. A communication system comprising a transmitting application server, a transmitting key server, a verification device, a receiving key server, and a receiving application server, wherein the transmitting application server includes an evidence generation unit that generates evidence relating to application functions and encrypted communication processing functions (hereinafter referred to as "first evidence") and executes a registration request for a reference value corresponding to the first evidence, and an encrypted communication processing unit that transmits the first evidence to the receiving application server, the transmitting key server includes an evidence generation unit that generates evidence relating to key exchange and sharing functions (hereinafter referred to as "second evidence") and executes a registration request for a reference value corresponding to the second evidence to the verification device, and a key exchange and sharing unit that transmits the second evidence to the receiving key server, the receiving key server includes an evidence generation unit that generates evidence relating to key exchange and sharing functions (hereinafter referred to as "third evidence") and executes a registration request for a reference value corresponding to the third evidence to the verification device, and a key exchange and sharing unit that transmits the third evidence to the transmitting key server, and the receiving application server, A communication system including an evidence generation unit that generates evidence (hereinafter referred to as "fourth evidence") relating to application functions and encrypted communication processing functions, and executes a request to the verification device to register a reference value corresponding to the fourth evidence, and an encrypted communication processing unit that transmits the fourth evidence to the transmitting application server.

4. A communication system according to claim 3, wherein the transmitting application server includes a verification unit that executes a verification request to the verification device based on the fourth evidence, the transmitting key server includes a verification unit that executes a verification request to the verification device based on the third evidence, the receiving key server includes a verification unit that executes a verification request to the verification device based on the second evidence, the receiving application server includes a verification unit that executes a verification request to the verification device based on the first evidence, and the verification device is a communication system that verifies the appropriateness of the operation of each function based on the received evidence and the corresponding reference value.

5. A communication system according to claim 1, wherein the evidence includes information specific to the key exchange / sharing method.

6. A communication system according to claim 3, wherein the evidence includes information specific to the key exchange / sharing method.

7. A communication method performed by a transmitting device, a verification device, and a receiving device, wherein the transmitting device performs the steps of: generating a key ID evidence which is an attestation report corresponding to a key exchange / sharing method for a key associated with a key ID; and executing a request to the verification device to register a reference value corresponding to the key ID evidence; and transmitting the key ID and the key ID evidence to the receiving device; and the receiving device performs the steps of: generating a key ID reference evidence which is an attestation report corresponding to a key exchange / sharing method for a key associated with a key ID shared with the transmitting device; and executing a request to the verification device to register a reference value corresponding to the key ID reference evidence; and transmitting the key ID reference evidence to the transmitting device.

8. A program that causes a computer to execute the communication method described in claim 7.

Images