JP2009303188A5

JP2009303188A5 -

Info

Publication number: JP2009303188A5
Application number: JP2008172561A
Authority: JP
Filing date: 2008-07-01
Publication date: 2011-10-06
Anticipated expiration: 2028-07-01

Claims

A first shared key that is shared between the registered communication terminal that has been authenticated in the authentication infrastructure and the device itself is generated, the generated first shared key is stored, and the registered communication is performed via the authentication infrastructure. A first shared key management unit to be transmitted to the terminal;
The "second common key generation information capable of generating a second shared key by using together with the first shared key" with non-registered communication terminal to receive without going through the authentication infrastructure, second covalent A key generation information management unit;
And a second shared key management unit that generates the second shared key using the first shared key and the second shared key generation information.

By performing encrypted communication using the second shared key with the non-registered communication terminal without going through the authentication infrastructure, the third shared key is shared with the non-registered communication terminal, and the third shared key is The management apparatus according to claim 1, further comprising a third shared key management unit that encrypts and transmits to another non-registered communication terminal using the second shared key corresponding to the other non-registered communication terminal.

An authentication management unit that receives authentication in the authentication infrastructure;
A first shared key management unit that shares a first shared key with a management device by communication via the authentication infrastructure;
Second shared key generation information that generates second shared key generation information that can be used together with the first shared key to generate a second shared key and stores the generated second shared key generation information The management department,
An output unit that outputs the second shared key generation information and the second shared key to an unregistered communication terminal.

A second shared key storage unit that stores a second shared key shared with the management apparatus and second shared key generation information for generating the second shared key;
Transmitting the second shared key generation information to the management device without going through an authentication infrastructure, and the second shared key generated by the management device and the second shared key storage unit storing the second shared key A third shared key management unit that shares the third shared key with the management device by performing encrypted communication using the management device,
With
An unregistered communication terminal that shares the third shared key with the other communication terminal by transferring the third shared key to the other communication terminal in the management device.

Includes a registered communication terminal, an unregistered communication terminal, an authentication infrastructure, and a management device, and guarantees confidentiality and integrity in communication between the registered communication terminal and the authentication infrastructure and communication between the authentication infrastructure and the management device. A network system,
The management device generates a first shared key that is shared between the registered communication terminal that has been authenticated by the authentication infrastructure and the device itself, stores the generated first shared key, and stores the authentication infrastructure To the registered communication terminal via
The registered communication terminal receives the first shared key from the management device, generates second shared key generation information that can be used together with the first shared key to generate a second shared key, Outputting the generated second shared key generation information and the second shared key to the unregistered communication terminal ;
The management device receives the second shared key generation information included in the unregistered communication terminal without passing through the authentication infrastructure, and uses the first shared key and the second shared key generation information to Generate a second shared key,
The registered communication terminal generates the second shared key using the first shared key and the second shared key generation information,
The network system, wherein the non-registered communication terminal receives and stores the second shared key generation information and the second shared key generated by the registered communication terminal.

The unregistered communication terminal generates a third shared key, encrypts the generated third shared key using the second shared key, and transmits the encrypted third shared key to the management device.
The management device receives the encrypted third shared key, generates the third shared key by decrypting using the second shared key, and other related to the other unregistered communication terminal Encrypting the third shared key using the second shared key and sending it to the other unregistered communication terminal,
The other non-registered communication terminal receives the encrypted third shared key, and generates and stores the third shared key by decrypting using the other second shared key. The network system according to claim 5, wherein the network system is characterized.

The management device generates a first shared key shared between the registered communication terminal and the own device that have been authenticated in the authentication infrastructure; and
The management device storing the generated first shared key;
The management device transmitting the first shared key to the registered communication terminal via the authentication infrastructure;
The management device, the "second common key generation information capable of generating a second shared key by using together with the first shared key" with non-registered communication terminal, receive without going through the authentication infrastructure And steps to
The management device storing the received second shared key generation information;
The management device includes the step of generating the second shared key using the first shared key and the second shared key generation information.

The management device sharing the third shared key with the non-registered communication terminal by performing encrypted communication using the second shared key with the non-registered communication terminal without going through the authentication infrastructure; ,
The management device includes a step of encrypting and transmitting the third shared key to another non-registered communication terminal using the second shared key corresponding to the other non-registered communication terminal. The management method described.

The registered communication terminal is authenticated in the authentication infrastructure;
The registered communication terminal sharing a first shared key with a management device by communication via the authentication infrastructure;
The registered communication terminal generating second shared key generation information that can be used together with the first shared key to generate a second shared key;
The registered communication terminal storing the generated second shared key generation information;
A method in which the registered communication terminal outputs the second shared key generation information and the second shared key to an unregistered communication terminal .

A non-registered communication terminal including a second shared key storage unit that stores a second shared key shared with the management apparatus and second shared key generation information for generating the second shared key does not pass through the authentication infrastructure. The second shared key generation information is transmitted to the management device, and the second shared key generated by the management device and the encrypted communication using the second shared key stored in the second shared key storage unit Sharing the third shared key with the management device by performing
The non-registered communication terminal includes a step of sharing the third shared key with the other communication terminal by transferring the third shared key to the other communication terminal in the management device.

Against the computer
Generating a first shared key to be shared between the registered communication terminal and the own device that have been authenticated in the authentication infrastructure;
Storing the generated first shared key;
Transmitting the first shared key to the registered communication terminal via the authentication infrastructure;
Receiving " second shared key generation information capable of generating a second shared key by using it together with the first shared key " possessed by an unregistered communication terminal without going through the authentication infrastructure;
Storing the received second shared key generation information;
And generating the second shared key using the first shared key and the second shared key generation information.

For the computer
Sharing the third shared key with the non-registered communication terminal by performing encrypted communication using the second shared key with the non-registered communication terminal without going through the authentication infrastructure;
The step of encrypting and transmitting the third shared key to another non-registered communication terminal using the second shared key corresponding to the other non-registered communication terminal. Computer program.

Against the computer
Receiving authentication in the authentication infrastructure;
Sharing the first shared key with the management device by communication via the authentication infrastructure;
Generating second shared key generation information that can be used together with the first shared key to generate a second shared key;
Storing the generated second shared key generation information;
A step of outputting the second shared key generation information and the second shared key to an unregistered communication terminal .

Against the computer
A non-registered communication terminal including a second shared key storage unit that stores a second shared key shared with the management apparatus and second shared key generation information for generating the second shared key does not pass through the authentication infrastructure. The second shared key generation information is transmitted to the management device, and the second shared key generated by the management device and the encrypted communication using the second shared key stored in the second shared key storage unit Sharing the third shared key with the management device by performing
A computer program for executing the step of sharing the third shared key with the other communication terminal by transferring the third shared key to the other communication terminal in the management device.

The registered communication terminal according to claim 3, further comprising a management device communication unit that adds the second shared key generation information to a session establishment request message transmitted to the management device.

The management device communication unit for performing a series of exchanges of information including the second shared key generation information to the management device within one session established with the management device. 3. The registered communication terminal according to 3.

The second shared key generation information management unit generates the second shared key generation information as information including user identification information of a self-registered communication terminal and identification information of an unregistered communication terminal. The registered communication terminal described.

The second shared key generation information is a GRUU identifier of the unregistered communication terminal,
The registered communication terminal according to claim 17, wherein the registered communication terminal registers the second shared key generation information with the authentication infrastructure.

The communication method according to claim 9, wherein the registered communication terminal adds the second shared key generation information to a session establishment request message transmitted to the management device.

The registered communication terminal performs a series of exchanges of information including the second shared key generation information with respect to the management apparatus within one session established with the management apparatus. The communication method described in 1.

The communication method according to claim 9, wherein the registered communication terminal generates the second shared key generation information as information including user identification information of the self-registered communication terminal and identification information of the unregistered communication terminal.

The second shared key generation information is a GRUU identifier of the unregistered communication terminal,
The communication method according to claim 21, wherein the registered communication terminal registers the second shared key generation information in the authentication infrastructure.

The computer program according to claim 13, further causing the computer to execute a step of adding the second shared key generation information to a session establishment request message to be transmitted to the management device.

The computer is further configured to cause the computer to further execute a step of exchanging a series of information including the second shared key generation information within one session established with the management device. 13. The computer program according to 13.

14. The computer program according to claim 13, wherein the second shared key generation information is generated as information including user identification information of a self-registered communication terminal and identification information of an unregistered communication terminal.

The second shared key generation information is a GRUU identifier of the unregistered communication terminal,
The computer program according to claim 25, further causing the computer to execute a step of registering the second shared key generation information with respect to the authentication infrastructure.