JPH0435538A - Encipherment communication system - Google Patents

Abstract

PURPOSE:To secure a high security by generating an intrinsic secret encipherment key of every communication other party every time of transmission by using an encipherment function contained in a security module, and enciphering and transmitting data by using the secret encipherment key. CONSTITUTION:The above system is configured by a host computer 1, terminals 2A, 2B for using IC cards A, B as security modules, and a network 3. In such a state, at the time of transmission, the transmitting node 2A uses an encipherment function contained in the security module such as an IC chip or an IC card A loaded with the IC chip, etc., generates an intrinsic secret encipherment key to every communication other party 2B every time of transmission, and enciphers and transmits data by using it. In such a way, separate keys used at the time of transmission and reception by each node 2A, 2B are made independent. Accordingly, the high security can be secured.

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Industrial Application] The present invention relates to an encrypted communication system, and particularly to an encrypted communication system that uses an IC card as a security module for data communication.

[Conventional technology]

In a personal computer communication network, data encryption is essential to ensure high security communication between an unspecified number of registrants.

In general, encryption methods are broadly classified into secret key encryption methods and public key encryption methods. In the former secret key cryptosystem, it is necessary for communicating parties to share a common secret key, and once the key is shared, both the sender and receiver can perform encryption/decryption.

On the other hand, the latter public #l! In the cryptographic system, encryption is possible even with Miyabi, but decryption is possible only by those who have the private decryption key. Therefore, higher security than the secret key encryption method described above can be achieved.

Regarding these, for example, reference may be made to the description in Chapter 5 of "Cryptography Corporation Mon" by Koshio Matsui (Morikita Publishing, published in 1986).

[Problem to be solved by the invention]

The above public key cryptosystem has the advantage of being able to achieve higher security than the private key cryptosystem described above, but there are problems with the complexity of the algorithm and the resulting slow processing speed, which is an impediment to its application to actual systems. It becomes.

Regarding this problem, the present applicant has filed a special fraud application (Patent Application No. 63-205927; [Key Sharing Method]), and
The technique proposed in "Individual key management method for rIC cards" by Miyaro and Iwata (Institute of Electronics, Information and Communication Engineers ISE C8B-37) is effective. The former is a high security communication method using a base key that is particularly effective for communication between one host and many ends, or communication between many ends relaying hosts, and the latter is a high security communication method that uses a base key. This paper proposes a technique that is effective when applied to a communication system that uses an IC card as a module.

The present invention is a further development of the above technology, and its purpose is to provide an encrypted communication method that can ensure higher security when using an IC card as a security module for data communication. It is about providing.

[Means for Solving the Problems] The above object of the present invention is such that the transmitting node and the receiving node
In an encrypted communication method that uses a security module for data communication, when a sending node sends data to a communication partner, it uses the built-in encryption function of the IC card to encrypt data unique to each communication partner. This is achieved by an encrypted communication method characterized in that a secret encryption key is generated each time data is transmitted, and data is encrypted and transmitted using the secret encryption key.

[Effect]

In the encrypted communication method according to the present invention, at the time of transmission,
The sending node uses the encryption function built into the security module such as an IC chip or an IC card equipped with an IC chip to generate a unique secret encryption key for each communication partner each time it sends a message, and uses this secret encryption key. data is encrypted using an encryption key and transmitted, and upon reception, the receiving node decrypts the data using an individual decryption key that is uniquely given to the node in advance;
By making the individual keys used by each security module, that is, each node for transmission and reception, completely independent, it is possible to ensure high security comparable to the public key cryptosystem described above with a simple configuration. It is something.

〔Example〕

Embodiments of the present invention will be described in detail below with reference to the drawings.

FIG. 2 is a diagram illustrating a configuration example of a communication system related to the encrypted communication method according to the present invention. In FIG. 0, 1 is a host computer, 2 people and 2B are terminals each using an IC card as a security module. (node), 3 indicates a network.

FIG. 3 is a diagram showing an example of the configuration of the IC card 10 used in the encrypted communication system according to the present invention. As shown in FIG. 6, the IC card IO shown in this embodiment has an external interface 11. Transmission control device 12. Encryption device 20. It consists of a secret area 30. Among the above-mentioned components, the external interface 11° and the transmission control device 12 are the same as those commonly used, so the explanation thereof will be omitted.

The secret area 30 is an area that cannot be read or verified from the outside, and includes a base key 31 that will be described later.
．． An individual key 32 for transmission and an individual key 33 for reception are stored. Among these, the base key 31 and the individual reception key 33 have values unique to the IC card and the terminal (node) using this IC card stored at all times. On the other hand, the individual transmission key 32 is a private encryption key unique to each communication partner that is generated and stored each time transmission is made, and is automatically deleted when transmission is completed. It is. Note that the secret area 30 can only be accessed from the encryption device 20, which will be described later.

Inside the encryption device 20, there is a data mixing device 21 for encrypting data to be transmitted. A data restoration device 22 is provided for decrypting received encrypted data. The data stirring device 21 includes an individual key generation device 23. which generates an individual key corresponding to the destination from input destination information (ID number, etc.) and the above-mentioned base key. It consists of an encryption device 24 that encrypts transmission data using the individual key generated by the individual key generation device 23.

The data encryption method using the IC card IO shown in this embodiment configured as described above is as follows. In addition, in the following description, the case where encrypted communication is performed from terminal (A) to terminal (B) shall be taken as an example. That is, as shown in FIG. 1(a), in response to the data encryption request command ■, the ID number of the communication partner is received (■).
Then, the IC card (A) IO uses the individual key generation device 23 to (temporarily) generate an individual key for the communication partner (B) from the ID number and base key in the above information (■) , the generated individual key for the communication partner (B) is stored in the aforementioned secret area (-).

Next, receive the transmission data (plaintext) to the communication partner (■
), and the above-mentioned encryption device 24 encrypts the transmission data using the transmission individual key generated above (
■), and send encrypted data ■)
, After successfully transmitting the data, erase the individual transmission key (■). The terminal (A) that has received the encrypted transmission data from the IC card (A) 10 transmits the data to the communication partner (B). (■) In this case, the transmission may be done directly via the network or may be sent using the mailbox addressed to terminal (B). Here, the mailbox is used. .

As shown in FIG. 1(b), the terminal (B) which is the receiving node takes out the encrypted data of its own terminal into the mailbox (■) and sends a data decryption request to the IC card (B) 10. (■), the I that received the data decryption request
The C card (B) 10 subsequently decrypts the received data (■) using the decryption key (B) and sends it to the terminal (B) (■) 6 According to the above embodiment. For example, the pace key for individual key management is stored in an area of the IC card that cannot be read or verified, and the data sent to the communication partner is encrypted with the individual key assigned to the communication partner. In fact, this individual key is the base key and the ID of the communication partner.
It is generated and used inside the IC card from the number, etc., and does not leak to the outside, and decryption of encrypted data is as follows.
Since it has functions such as being able to decrypt only with the individual key assigned to you, it has the effect of making it possible to ensure high security comparable to the public key encryption method described above with a simple configuration. It requires

The above embodiment is shown as an example of the present invention,
It goes without saying that the present invention is not limited to this. For example, as a security module, an IC having the encryption/decryption function shown in the above embodiment may be used.
In addition to the card, there is also a plug-in type IC chip itself having similar functions, or an expansion board containing the IC chip.

It can be realized in the form of a plug, connector, etc.

Furthermore, this communication method is used in the following manner in personal computer communication using a personal computer (personal computer).

When communicating between the communicator (A) and the receiver (B),
The communication party (A) receives the IC card (A) with his or her registration number (ID number) set, a dedicated reader/writer, and a terminal emulator, and also receives the ID numbers of all registrants to the computer communication network. When a user (communicator) accesses a PC communication service, the user (communicator) is checked for legitimacy at each of the following levels.

■ Confirmation of authenticity by password verification between the user and the card ■ Confirmation of authenticity between the card and the host or terminal emulator If the above confirmation is successfully completed, the user will be able to receive the service for the first time. can.

When transmitting data, the ID number address of the recipient (B) is sent to the IC card, the data is encrypted, and the result is posted in the recipient's mailbox.

When receiving data, the recipient (B) takes out the encrypted data from his or her mailbox and decrypts it using an IC card.

Note that the details of encryption and decryption are as described above.

[Effects of the Invention] As described above in detail, according to the present invention, when a sending node and a receiving node transmit data to a communication partner in an encrypted communication method in which data communication is performed using a security module, In this case, the encryption function built into the security module is used to generate a unique private encryption key for each communication partner each time the communication is sent, and the data is encrypted and transmitted using the private encryption key. By doing so, it is possible to achieve the remarkable effect of realizing an encrypted communication system that can ensure higher security.

[Brief explanation of drawings]

FIG. 1 is a flowchart showing operations during transmission and reception in encrypted communication according to an embodiment of the present invention, FIG. 2 is a diagram illustrating a configuration example of an encrypted communication system according to the present invention, and FIG. 1 is a diagram showing an example of the configuration of an IC card used in an encrypted communication system according to an embodiment of the present invention. ]0: IC card, 11: External interface, 12:
Transmission control device, two-way encryption device, 21: data stirring device,
22: Data restoration device, 23: Individual key generation device, 24:
Encryption device, 30: Secret area, 31: Base key, 32
: Individual key for transmission, 33: Individual key for reception. ■

Claims (6)

[Claims] (1) In an encrypted communication method in which a sending node and a receiving node perform data communication using a security module with an encryption function, when the sending node sends data to the communication partner, the security module has a built-in An encrypted communication characterized in that a private encryption key unique to each communication partner is generated each time a transmission is made using the encryption function provided by the user, and the data is encrypted and transmitted using the secret encryption key. method. (2) The private encryption key unique to each communication partner is a base key stored in the security module;
2. The encrypted communication method according to claim 1, wherein the encrypted communication method is generated from information (ID) corresponding to the communication partner and is deleted after the encryption using this information is completed. (3) The base key and the private encryption key unique to each communication partner are stored in an area within the security module that cannot be read or verified from the outside. The encrypted communication method described in 2. (4) A receiving node that receives data encrypted using a private encryption key unique to each communication partner encrypts the data using an individual decryption key that is uniquely given to the node in advance. Claims 1-1 characterized in that decoding is performed.
3. The encrypted communication method according to any one of 3. (5) In an encrypted communication method in which a sending node and a receiving node perform data communication using a security module having an encryption function, when the sending node sends data to the communication partner, the security module has a built-in A private encryption key unique to each communication partner is generated each time a transmission is made using the encryption function created by the communication partner, and the data is encrypted and sent using the private encryption key, and the receiving node An encrypted communication method characterized in that the data is decrypted using an individual decryption key that is uniquely given to the security module in advance. (6) The encrypted communication method according to any one of claims 1 to 5, wherein the security module is an IC card.