JP3296514B2 - Encryption communication terminal - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a cryptographic communication terminal in which any two terminals establish a connection and perform cryptographic communication using a common key cryptographic algorithm, and more particularly to a plurality of cryptographic communication terminals via a network. The present invention relates to a cryptographic communication terminal in which a communication terminal is connected to a key distribution center and two arbitrary cryptographic communication terminals establish a connection and perform cryptographic communication by obtaining a session key generated by the key distribution center via a network.

[0002]

2. Description of the Related Art This type of cryptographic communication system can be effectively used when performing cryptographic communication within a specific group such as offices distributed over a wide area. After establishing a connection with the communication partner terminal, one of the application programs accesses the key distribution center to acquire a session key used for communication. By transmitting the session key to the communication partner terminal, it is common to share a common key, encrypt (decrypt) subsequent communication data using this key, and perform encrypted communication.

[0003]

In the conventional method as described above, prior to cryptographic communication, an application program running on a terminal establishes a connection with a key distribution center, obtains a session key from the key distribution center, and Processing for transmitting the same session key to the application of the communication partner terminal is required. On the other hand, the number of communication programs that perform communication between terminals via a connection-type network is enormous, and when these are changed to support encrypted communication,
It is necessary to individually remodel the application programs, which leads to a problem that the remodeling scale and the number of man-hours increase, and the development cost also increases accordingly.

[0004] The present invention has been made in view of the above,
Its purpose is to detect a connection establishment request from an application program, obtain a session key by accessing a key distribution center, and transmit the same session key to a communication partner terminal to share a common key. Accordingly, an object of the present invention is to provide a cryptographic communication terminal capable of performing cryptographic communication without affecting existing application programs.

[0005]

In order to achieve the above object, a cryptographic communication terminal according to the present invention comprises a plurality of cryptographic communication terminals connected to a key distribution center via a network, and a session key generated by the key distribution center. Is obtained via a network so that any two cryptographic communication terminals establish a connection and perform cryptographic communication. The cryptographic communication terminal communicates with another cryptographic communication terminal when Connection request detection means for detecting a connection establishment request from an application, session key request means for establishing a connection with a key distribution center in response to detection of the connection establishment request, and requesting a session key from the key distribution center; A connection between the receiving means for receiving and holding the session key transmitted from the center and other cryptographic communication terminals Another terminal connection establishing means, and a session key transmitting means for transmitting a session key received by the receiving means to another cryptographic communication terminal when the other terminal connection establishing means establishes a connection with another cryptographic communication terminal. And a session key receiving means for receiving and holding a session key transmitted from the cryptographic communication terminal that has received the session key when it becomes another cryptographic communication terminal, and transmitting the session key to another cryptographic communication terminal. Abstract: Encrypting means for encrypting communication data with a session key and transmitting it to another encrypted communication terminal, and decrypting means for decrypting communication data transmitted from the other encrypted communication terminal with a session key. And

[0006]

The cryptographic communication terminal of the present invention detects a connection establishment request with a communication partner terminal from an application program running on the cryptographic communication terminal, establishes a connection with a key distribution center in response to the detection, and performs key distribution. Request the session key from the center. The cryptographic communication terminal receives the two encrypted session keys transmitted from the key distribution center, decrypts and holds the session key of its own terminal with its own encryption key, and establishes a connection with another cryptographic communication terminal. The encrypted session key of another cryptographic communication terminal is transmitted in the procedure for establishing Upon receiving the session key, the other cryptographic communication terminal decrypts and holds the session key using its own encryption key. The own terminal and another cryptographic communication terminal can perform cryptographic communication using a common session key.

[0007]

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 is a block diagram showing a configuration of a cryptographic communication system including a cryptographic communication terminal according to one embodiment of the present invention. In this embodiment, a description will be given of a TCP / IP / LAN that performs communication using a connection-type protocol as an example.

In FIG. 1, 1 is a key distribution center for generating a session key and transmitting it to the cryptographic communication terminal 3. 2 is a key distribution center between the key distribution center 1 and the cryptographic communication terminal 3 and the cryptographic communication terminal 3.
A network 3 for establishing a connection between the communication terminal 3 and the cryptographic communication terminal 3 and performing communication is a cryptographic communication terminal (# 1 to #n) for performing communication.

[0010] The key distribution center 1 includes a connection control means 11 for establishing a connection with the cryptographic communication terminal 3 and a receiving means 12 for receiving a port identifier from the cryptographic communication terminal 3.
A transmitting unit 13 for transmitting a session key to be described later to the cryptographic communication terminal 3, a random number generating unit 14 for generating a random number to generate a session key, and a key for searching (or generating) the cryptographic key of the cryptographic communication terminal 3. Management means 15 and encryption means 16 for encrypting the session key generated by random number generation means 14 with the encryption key of cryptographic communication terminal 3 generated by key management means 15
It is composed of

Each terminal 3 establishes a connection with the key distribution center 1 upon the detection of a connection request detecting means 31 for detecting a connection establishment request from an application program, and establishes a connection with the other terminals 3. The connection control means 32 establishes and transmits a session key described later, and transmits the port identifiers of the own terminal 3 and the other terminal 3 to the key distribution center 1;
Transmission means 33 for transmitting the encrypted communication data (hereinafter referred to as cipher text) to the other terminal 3, and receiving means 34 for receiving the session key from the key distribution center 1 and receiving the cipher text from the other terminal 3. And a key management unit 35 for storing the encryption key of the terminal 3 and the session key from the key distribution center 1.
In addition to decrypting the session key with the encryption key and encrypting the ciphertext into the original communication data (hereinafter referred to as plaintext) or the plaintext into ciphertext during communication with the other terminal 3,
And decoding means 36.

The other terminal 3 receives the session key from the own terminal 3, decrypts the session key with the encryption key held in the key management unit 35, holds it in the key management unit 35, and establishes a connection with the own terminal 3. Used as an encryption key for encrypted communication.

FIG. 2 describes a protocol used in TCP / IP / LAN based on the OSI reference model. The physical and data link layers are MAC (Media Access
Control) protocol, network layer is IP (In)
ternet Protocol), transport layer is TCP
(Transmit Control Protocol), and the application program (hereinafter abbreviated as AP) is TC
A connection is established between P layers.

FIG. 3 shows a frame format used for communication between two terminals connected to the TCP / IP LAN. The frame is a MAC header (MAC _- H),
It consists of a header consisting of an IP header (IP _- H) and a TCP header (TCP _- H), a data part of the AP and a frame check sequence of the entire frame. By encrypting the data portion of the AP, communication can be performed using a network via an IP router. A different session key is used for each connection in order to prevent a malicious terminal from monitoring or falsifying a message due to spoofing. The connection with the communication partner terminal is uniquely determined by the IP address (defined in the IP header) of the transmitting side and the port number (defined in the TCP header) of the TCP layer and the IP address and port number of the receiving side. .

FIG. 4 shows a header format of the TCP layer. In the figure, ^the ,, ^and parts are not relevant to the present invention, and thus description thereof is omitted here. In the figure ^, SRC _- PORT
^And, DST _- ^PORT, shows each source port number, the destination port number. A connection with a communication partner terminal is established / disconnected using a control flag (CF: Control Flag) of the TCP header. Connection ^{establishment,, SYN, and,} using ^ACK, the flag, disconnection ^{is, FIN,} and ^{using ACK,} the flag, the 3-way handshake is realized. For details of the connection establishment / disconnection procedure, see "Uehara:
Heterogeneous connection and LAN picture reading book, pp. 137-14
1, Ohmsha ".

FIG. 5 shows a key distribution procedure. There are three cases shown in FIGS. 5A, 5B, and 5C depending on when to access the key distribution center in the connection establishment procedure. Since the basic concept is the same, only the procedure of case I shown in FIG. 5A will be described in detail. The procedure is shown below. Note that the transmitting terminal T
_i and the reception side terminal T _j encryption key K _i and K _j holds each inside terminal at the time of installation of the terminal,
It is made so that it cannot be seen from the outside. In the following description, the transmitting terminal T _i and the receiving terminal T _j are abbreviated as T _i and T _j , respectively.

[0017] [Step 1] T _i is, when it detects a connection establishment request from the AP, and access to key distribution center,
By the key acquisition procedure (FIG. 5) described later, T _i and T
_{j The} session key (C _i ) encrypted with each encryption key
And C _j ) are received from the key distribution center (FIG. 2).

[0018] [Step 2] a C _i is decrypted by the encryption key K _i of T _i, to obtain the session key K _s (FIG). K _s
It holds up to disconnect the connection of the T _j.

[0019] [Step 3] T _i is the T ^{_j, SYN,} by a flag, requests a connection establishment (FIG).

[0020] [Step 4] T _j is the T ^{_i, ACK, and, SYN,} by a flag, returns a response and a connection establishment request (drawing).

[0021] [Step 5] T _i is the T ^_j, transmits ^ACK, a C _j received from the key distribution center with a flag (FIG).

[Procedure 6] T _j receives C _j from T _i (the same figure).

[Procedure 7] T _j decrypts C _j using its own encryption key K _j and obtains a session key K _s (FIG. 6). K _s is, hold up to disconnect the connection of the T _i.

Note that K _s = dK _i (C _i ) is the cipher text C
_i is the result of decoding the encryption key K _i a.

[Procedure 8] Afterward, the common session key K _s
Can be used to perform encrypted communication between _Ti and _Tj (FIG. 1).

FIG. 6 shows a key acquisition procedure for the terminal T _i (or T _j ) to access the key distribution center and acquire the session key K _s . The procedure is shown below.

[0027] [Step 1] T _i is, the key distribution ^center, SY
N ^, the connection is requested by ^the flag (FIG. 6)
of).

[0028] [Step 2] key distribution center, in T ^_i, AC
^{K, and, SYN,} by a flag, returns a response and a connection establishment request (drawing).

[0029] [Step 3] T _i is, the key distribution ^center, AC
The connection is established by returning K ^{and the} flag (FIG. 3). This establishes a connection between T _i and the key distribution center.

[Procedure 4] T _i transmits the port identifiers ID _i and ID _j of T _i and T _j to the key distribution center (the same figure). Note that ID _i / ID _j is a numerical value obtained by connecting an IP address and a port number.

[0031] [Step 5] key distribution center generates a random number, and generates a session key K _s. Furthermore, the search based on the T _i and T _j of the encryption key K _i and K _j the ID _i and ID _j (or product) to. Where _Ki and K
_The method for retrieving (or generating) _j is not relevant to the present invention, and thus the details are omitted. When _Ki and _Kj are obtained by searching, it is needless to say that means for registering the port identifier and the encryption key of the terminal to be used in the database of the key distribution center is required. In addition, a method for generating a K _i and K _j is, "Oyaizu, Tanaka: key distribution system using the UUI, Technical Report of IEICE, OFS92-31" see.

Using the above K _i and K _j , K _s is encrypted to generate C _i and C _j (FIG. 2).

Note that C _i = eK _i (K _s ) is a plain text K _s
Which is a result that has been encrypted with the encryption key K _i.

[Procedure 6] The key distribution center transmits C _i and C _j to T _i (FIG. 6).

[0035] [Step 7] T _i is, the key distribution ^center, FI
N ^{, a} request to disconnect the connection is made by ^the flag (FIG. 9).

[0036] [Step 8] key distribution center, in T ^_i, AC
A response is returned according to K ^{and the} flag (FIG. 9).

[0037] [Step 9] key distribution center, in T ^_i, FI
N ^{, a} request to disconnect the connection is made by ^the flag (FIG. 9).

[0038] [Step 10] T _i is, the key distribution ^center, A
Response is returned by CK ^and flag

[Outside 1] While there has been described an example of a key acquisition procedure, ID steps 4 _i
And ID _j steps ^{1, SYN,} sent with a flag, of C _i and C _j in Step 6 Step ^{2, SYN,} and ^may send ^ACK, along with the flag. In this case, steps 4 and 6 can be deleted.

The present invention does not specify a key distribution algorithm. Therefore, by changing the content of the data to be transmitted (here, ID _i , ID _j , C _i, and C _j ), the other terminal can be authenticated (Koyanatsu, Tanaka: UU
Key distribution method using I, IEICE Technical Report, OFS92-31
Needless to say).

[0040]

As described above, according to the present invention,
The key distribution center is accessed in response to a connection establishment request from an application program running on the cryptographic communication terminal, a session key used for communication is obtained, and the session key is transmitted to the partner terminal in the connection establishment procedure with the partner terminal. Is transmitted, and a common session key is shared between any two cryptographic communication terminals, and cryptographic communication is performed using this session key. Therefore, there is no need to remodel existing applications as in the conventional case, and economy is achieved. Can be achieved.

[Brief description of the drawings]

FIG. 1 is a block diagram illustrating a configuration of a cryptographic communication system according to an embodiment of the present invention.

FIG. 2 is a diagram showing a protocol used in TCP / IP LAN.

FIG. 3 is a diagram showing a frame format of TCP / IP LAN.

FIG. 4 is a diagram showing a header format of a TCP layer.

FIG. 5 is a diagram showing a key distribution procedure.

FIG. 6 is a diagram showing a key acquisition procedure between a key distribution center and a terminal.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Key distribution center 2 Network 3 Terminals 11, 32 Connection control means 12, 33 Transmission means 13, 34 Receiving means 14 Random number generation means 15, 35 Key management means 16 Encryption means 31 Connection request detection means 36 Encryption / decryption means

Continuation of the front page (56) References JP-A-63-274242 (JP, A) JP-A-4-179326 (JP, A) Toshikazu Yamaguchi, Kiyoto Tanaka, Katsuhiro Tanabe, Tsukuo Koyanagi, "LAN Encryption Communication , "IEICE Technical Report (OFS93-32), Japan, January 21, 1994, Vol. 93, no. 435, p. 13-18 Toshikazu Yamaguchi, Kiyoto Tanaka, Katsuhiro Tanabe, Tsukuo Koyanagi, "Implementation and Evaluation of LAN Encryption Communication System", IEICE Technical Report (OFS93-38), Japan, March 11, 1994, Vol. 93, no. 508, p. 7-12 Toshikazu Yamaguchi, Kiyoto Tanaka, Katsuhiro Tanabe, Tsukuo Koyanagi, "LAN Security Communication Technology-Encrypting Communication Data in the TCP Layer-", NTT R & D, Japan, The Electronic Communication Association, July 1995 8th, Vol. 44, no. 9, pp. 653 −660 (58) Field surveyed (Int.Cl. ⁷ , DB name) H04L 9/08 H04L 29/02

Claims (1)

(57) [Claims] 1. A plurality of cryptographic communication terminals via a network
The other end is connected to a key distribution center, and any two cryptographic communication terminals establish a connection and perform cryptographic communication by obtaining a session key generated by the key distribution center via a network. Te, the encryption communication terminal establishes a connection request detecting means for detecting a connection establishment request from an application to communicate with another cryptographic communication terminal, the key distribution center and a connection in response to detection of the connection establishment request , Session key to key distribution center
Key requesting means for requesting a password , receiving means for receiving and holding a session key transmitted from the key distribution center, other terminal connection establishing means for establishing a connection with another cryptographic communication terminal , and the other terminal connection Established means for other cryptographic communication terminals
A session key transmission means for transmitting the session key received by said receiving means when establishing a connection with the end to another cryptographic communication terminal, if it becomes another cryptographic communication terminal, cryptographic receiving the session key a session key receiving means for holding and receiving the session key transmitted from the communication terminal, encrypting means for encrypting and transmitting the communication data to be transmitted to another cryptographic communication terminal with the session key to the other cryptographic communication terminal If, cryptographic communication terminal; and a decoding means for decoding the communication data transmitted from another cryptographic communication terminal with the session key.