Ciphering key delivery system its method

Description: TECHNICAL FIELD [Detailed description of the invention]

【0001】

[Industrial application field]

The present invention relates to a cryptographic key distribution system and a method for delivering a cryptographic key from a key center having a cryptographic key to an unspecified number of terminals via a public line.

【0002】

[Conventional technology]

In a system consisting of a key center and an unspecified number of terminals connected to the key center via a public line, the first encrypted AP (application) and the terminal program for using this system go through the network. Or, it is distributed to an unspecified number of terminal users by a method such as using an information recording medium. In such a system, the key center delivers a certain encryption key (hereinafter referred to as an AP key) to the terminal in order to decrypt the AP.

【0003】

Ideally, such a system satisfies the following conditions.

【0004】

(Condition 1) The terminal program cannot be analyzed.

【0005】

(Condition 2) The AP key acquired by the terminal and the program that decrypts the AP shall be protected from unauthorized use.

【0006】

(Condition 3) The encryption method of the encrypted AP distributed to the terminal user and the encryption method for encrypting the signal on the line shall have sufficient strength.

【0007】

In the following, the use of the AP by the terminal user without connecting to the key center using a legitimate protocol is referred to as unauthorized use.

【0008】

Generally, for (Condition 3), a method that guarantees a certain strength has been proposed. However, in (Condition 1) and (Condition 2), the method of using special hardware may be difficult due to cost reasons, etc., and it is also necessary to take a software protection method. In this case, in principle, it is possible to analyze the terminal program or obtain the AP key acquired by the terminal, and the protection level becomes a matter of degree.

【0009】

In the above system, unauthorized use is possible depending on the protocol method between the terminal and the key center by intercepting the line between the key sensor and the terminal by a malicious terminal user.

【0010】

For example, as shown in Fig. 1, consider a protocol method in which the AP key from the key center is simply encrypted and delivered in response to the request for the AP key from the terminal. This is referred to as the conventional method A.

【0011】

In the conventional method A, the information required for the request of the user authenticator and the AP to be used in the terminal is encrypted using the public key Ke distributed in advance by the public key cryptosystem E as an encryption key, and the key center supports Ke. Decrypt with the private key Kd, encrypt the requested AP decryption key K1 with the public key Ke'and send it to the terminal, and charge the user for the AP. The terminal obtains K1 by decoding the signal received by the pre-distributed private key Kd'corresponding to the public key Ke'. Here, the transmission of the user authenticator may be omitted.

【0012】

The private key cryptosystem is a method in which the encryption key and the decryption key are the same, whereas the public key cryptosystem is a method in which the encryption key and the decryption key are different. The above-mentioned conventional method A uses public key cryptography, but if the key is shared secretly and securely by some method first, the private key cryptography may be used instead of public key cryptography. is assumed.

【0013】

In this conventional method A, even if the system satisfies (Condition 1) to (Condition 3), the following illegal use of AP is possible. That is, since the same AP key is transmitted to the same AP, the same signal will flow on the line every time. In this case, a dummy that records the signal once connected to the key center and reproduces it. By creating a key center, it is possible to illegally use the AP (unauthorized use of the AP by spoofing the center in line interception / recording).

【0014】

Such fraudulent use is effective when the AP billing method is a method of billing each time it is used. At this time, since the terminal receives the same signal for the same AP every time, the first time it is used normally to intercept and record the signal, and the second and subsequent uses do not connect to the key center. All you have to do is input the recorded material to the terminal.

【0015】

However, for each AP, it is necessary to properly connect to the key center only the first time. Therefore, if the billing method is such that the software of the AP is sold out, that is, if the terminal side sends the key to the AP once and the same AP key can no longer be sent, the above fraudulent use is possible. Not satisfied.

【0016】

In order to deal with this, as shown in Fig. 2, it is assumed that a protocol method is adopted in which a random number or the like is generated on the terminal side and transmitted to the key center, and the key center encrypts and delivers the AP key based on the random number. This method will be referred to as the conventional method B below.

【0017】

In the conventional method B, the information required for the request of the user authenticator and the AP to be used in the terminal and the random number K3 generated in the terminal are encrypted with the pre-distributed public key K2e, which corresponds to the key center K2e. Decrypt with the private key K2d, then encrypt the AP key K1 requested by the private key encryption method E'using the random number K3 as the encryption key, and send it to the terminal. The terminal decodes the signal received by the previously generated random number K3 to obtain K1. Here, the transmission of the user authenticator may be omitted.

【0018】

In this conventional method B, a different signal flows through the line each time, so when the system satisfies (Condition 1) to (Condition 3), a third party who intends to use the AP illegally intercepts and records the line and performs a dummy center. Even if you create and input it to your terminal program, you cannot use the AP illegally because it checks whether the signal input with the same random number generated by you is encrypted inside the terminal.

【0019】

However, in this conventional method B, even when (Condition 1) to (Condition 3) are satisfied, there is no unauthorized use of the AP as described above, but for example, the following illegal use can be performed.

【0020】

The third party intercepts and records the signal from the original terminal user to the center, and sends it to the center. Here, if the public line using this service does not have a function to confirm the outgoing ID like a telephone, the information sent from the terminal to the center for personal authentication can be reproduced basically by intercepting and recording the line. When the center receives the signal from the terminal, it sends the corresponding signal and charges if the AP used at this time is charged.

【0021】

In this way, the third party can have the terminal user send an AP key that is not originally needed from the center and charge the AP usage fee (illegal charge by impersonating the terminal in line interception / recording).

【0022】

Also, as mentioned above, (Condition 1) and (Condition 2) are not always completely satisfied. Especially when protected by software technology, analysis of terminal software is difficult but often possible in principle.

【0023】

In such a case, the easiest auxiliary means that can be performed for program analysis is line interception / recording. This is because if the meanings of the input and output signals of the terminal program can be analyzed, the function of the terminal program itself can be clarified.

【0024】

For example, the following inference can be made for the above-mentioned conventional method B. First, the normal (non-illegal) use of the AP is performed, and the meaning is analyzed. Since the encrypted AP is initially in the hands of the terminal user and does not change, the key to decrypt it for the same AP does not change either. On the other hand, since it can be seen from the interception of the line that the received signal of the terminal program is different each time for the same AP, it can be seen that the signal is changed in some way such as a random number. However, in order to decode the signal and obtain the AP key, the terminal side must know what kind of rule the signal that changes each time changes. Since the signal makes only one round trip in this method, it is clear that the terminal side first specifies the change rule, and if you check the change rule specified by the terminal program, it will be very useful for unauthorized use. You can see that.

【0025】

In the conventional method B, when the terminal program is analyzed from the above viewpoint, the AP key itself does not change and the signal actually transmitted and received changes even if the signal content is encrypted and unknown. The meaning of each signal can be determined almost uniquely by inferring from. Therefore, the difficulty of analysis is greatly reduced except when analysis is impossible in principle.

【0026】

In order to deal with such problems, encryption of information on the line and simple fluctuation of signals on the line depending on random numbers are not sufficient.

【0027】

In addition, when the terminal program is realized only by software without being protected by hardware, it is often possible in principle, although it is difficult to analyze.

【0028】

A user who intends to use the AP illegally may perform the easiest line interception / recording on his / her own terminal in order to analyze the terminal program. At this time, it is possible to use it for the analysis of the terminal program by intercepting and recording the signals between the terminal and the center several times and simply comparing them.

【0029】

Therefore, in a situation where a malicious terminal user may spoof by intercepting or recording an intermediate line, simply encrypting the signal on the line is not sufficient to prevent unauthorized use.

【0030】

[Problems to be Solved by the Invention]

As mentioned above, in situations where a malicious terminal user may intercept the intermediate line, spoof by recording, analyze the terminal program, etc., simply encrypt the signal on the line or complicate the terminal program. Instead, it is necessary to deal with fraudulent use and fraudulent billing by creating dummy key centers / terminals and facilitating the analysis of terminal programs.

【0031】

The present invention has been made in view of the above, and an object of the present invention is to prevent the creation of a dummy key center / terminal, give as little hint as possible to the analysis of the terminal program, and illegally use or charge illegally. It is an object of the present invention to provide an encryption key distribution system and a method capable of preventing and reliably delivering an encryption key.

【0032】

[Means for solving problems]

In order to achieve the above object, the present invention (claim 1) is an encryption key in a system consisting of a key center having an encryption key to be delivered and a plurality of terminals connected to the key center via a public line. (A) A key request signal containing the first random number generated by each terminal is transmitted from each terminal to the key center, and the encryption key required by each terminal is shown to the key center. That, (b) a terminal check signal containing the second random number generated at the key center is transmitted from the key center to each terminal, and (c) the first random number and terminal check generated at each terminal. Sending a terminal response signal containing a value based on the first random number and a second random number, which is obtained based on the second random number included in the signal, from each terminal to the key center, and ( d) Based on the value based on the first random number included in the terminal response signal and the second random number, based on the first random number included in the key request signal and the second random number generated at the key center. Check at the key center to confirm the validity of access from each terminal, and (e) send the key delivery signal including the encryption key requested by the key request signal from each terminal in step (d) above. Only when the legitimacy of the access is confirmed, the key center provides a transmission method to each terminal, and an encrypted key delivery method consisting of the key is provided.

【0033】

Further, in the present invention (claim 2), in the step (a), the key request signal is generated by encrypting the first random number using the public key at each terminal, and the key center corresponds to the public key. It is characterized in that a first random number is obtained by decoding a key request signal using a private key.

【0034】

Further, in the present invention (claim 3), in the step (b), the terminal check signal is generated by encrypting the second random number using the first random number included in the key request signal at the key center. Each terminal is characterized in that a second random number is obtained by decoding a terminal check signal using the first random number generated in each terminal.

【0035】

Further, in the present invention (claim 4), in the step (c), the terminal response signal is a value based on the first random number and the second random number included in the terminal check signal by using the public key at each terminal. Is generated by encrypting, and the key center decrypts the terminal response signal using the private key corresponding to the public key, so that the value based on the first random number and the second random number included in the terminal response signal are obtained. It is characterized by obtaining.

【0036】

Further, in the present invention (claim 5), in the step (c), as for the value based on the first random number, the first random number is input to the multivalued function at each terminal, and a large number of outputs of the multivalued function are output. It is characterized in that it is a multivalued function output obtained by selecting one of the above.

【0037】

Further, in the present invention (claim 6), in the step (d), the value based on the first random number is the terminal in which the first random number included in the key request signal is input to the multivalued function at the key center. It is characterized in that the value based on the first random number included in the response signal is checked by comparing it with a large number of outputs of the multivalued function.

【0038】

Further, the present invention (claim 7) is characterized in that, in the step (c), the value based on the first random number is the first random number itself.

【0039】

Further, in the present invention (claim 8), in the step (e), the key distribution signal uses a value based on the first random number included in the terminal response signal at the key center and a second random number to obtain an encryption key. Generated by encryption, each terminal decrypts the key distribution signal using the value based on the first random number obtained by each terminal and the second random number included in the terminal check signal to obtain the encryption key. It is characterized by obtaining.

【0040】

Further, in the present invention (claim 9), in the step (e), whether the key delivery signal is the first random number included in the key request signal at the key center or the second random number generated at the key center. It is generated by encrypting the encryption key using either the value based on the first random number included in the terminal response signal, and each terminal is used as the first random number generated by each terminal or the terminal check signal. It is characterized in that an encryption key is obtained by decoding a key delivery signal using either a second random number included or a value based on the first random number obtained by each terminal.

【0041】

Further, in the present invention (claim 10), the steps (a)-(e) further generate (a1) the first random number, and encrypt the first random number using the public key. Generating the key request signal at the terminal, (a2) transmitting the key request signal generated in the step (a1) from each terminal to the key center, and (a3) transmitting in the step (a2). Obtaining the first random number at the key center by decrypting the key request signal using the private key corresponding to the public key, and (b1) generating the second random number, and obtaining it in the step (a3). A terminal check signal is generated at the key center by encrypting the second random number using the first random number, and (b2) the terminal check signal generated in the above step (b1) is generated from the key center. Sending to the terminal, (b3) obtaining the second random number at each terminal by decoding the terminal check signal transmitted in the step (b2), and (c1) the first random number at each terminal. Is input to the multi-valued function, and the multi-valued function output is obtained by selecting one of the many outputs of the multi-valued function, and (c2) the second random number obtained in the above step (b3). A terminal response signal is generated at each terminal by encrypting the multi-valued function output obtained in the step (c1) using the public key, and (c3) the terminal generated in the step (c2). The response signal is included in the terminal response signal at the key center by transmitting the response signal from each terminal to the key center and (c4) decoding the terminal response signal transmitted in the step (c3) using the private key. Obtaining the second random number and the multi-valued function output, and (d1) whether the second random number obtained in the step (c4) matches the second random number generated in the step (b1). In the key center, and (d2) whether the multi-valued function output obtained in the step (c4) is the true output of the multi-valued function is the first obtained in the step (a3). Checking at the key center by inputting a random number into the multi-valued function and comparing the multi-valued function output obtained in the step (c4) with a large number of outputs of the multi-valued function, and (d3) the above-mentionedIt is confirmed that the second random number obtained by the step (d1) in the step (c4) matches the second random number generated in the step (b1), and the step (d2) is the step (c4). When it is confirmed that the multi-valued function output obtained in step 2 is the true output of the multi-valued function, the validity of access from each terminal is confirmed, and (e1) the first step (c4) obtained in step (c4). The key delivery signal is generated at the key center by encrypting the encryption key using the second random number and the multi-value function output, and (e2) the key delivery signal generated in the above step (e1) is transmitted from the key center. Sending to each terminal, (e3) the key delivery signal transmitted in the step (e2), the second random number obtained in the step (b3), and the multi-valued function output obtained in the step (c1). It is characterized in that it includes obtaining an encryption key at each terminal by decrypting using.

【0042】

Further, the present invention (claim 11) is provided in each terminal with a key center having an encryption key to be delivered, a plurality of terminals connected to the key center via a public line, and each terminal. A key request means including a generated first random number is transmitted from each terminal to the key center to indicate the encryption key required by each terminal to the key center, and a key request means provided at the key center is provided at the key center. A terminal check means for transmitting a terminal check signal including the generated second random number from the key center to each terminal, and a terminal check means provided in each terminal and included in the first random number and the terminal check signal generated in each terminal. To the key center and the terminal response means that transmits the terminal response signal including the value based on the first random number and the second random number, which is obtained based on the second random number, from each terminal to the key center. The value based on the first random number and the second random number provided in the terminal response signal are based on the first random number included in the key request signal and the second random number generated in the key center. The check means for checking the validity of access from each terminal and the key delivery signal provided at the key center and including the encryption key requested by the key request signal are checked at the key center. Only when the validity of access from each terminal is confirmed, a key delivery means for transmitting from the key center to each terminal and an encrypted key delivery system consisting of the key delivery means are provided.

【0043】

Further, in the present invention (claim 12), the key requesting means uses a public key to encrypt a first random number to generate a key request signal, and the key center uses a private key corresponding to the public key. It is characterized in that the first random number is obtained by decoding the key request signal.

【0044】

Further, in the present invention (claim 13), the terminal check means uses the first random number included in the key request signal to encrypt the second random number to generate a terminal check signal, and each terminal generates the terminal check signal. It is characterized in that a second random number is obtained by decoding a terminal check signal using the first random number generated in each terminal.

【0045】

Further, in the present invention (claim 14), the terminal response means uses a public key to encrypt a value based on the first random number and a second random number included in the terminal check signal to obtain a terminal response signal. The key center generates and decodes the terminal response signal using the private key corresponding to the public key to obtain a value based on the first random number and a second random number included in the terminal response signal. It is a feature.

【0046】

Further, in the present invention (claim 15), the terminal response means inputs a first random number into a multivalued function at each terminal and selects one of a large number of outputs of the multivalued function. It is characterized in that the function output is obtained as a value based on the first random number.

【0047】

Further, in the present invention (claim 16), the checking means inputs the first random number included in the key request signal into the multivalued function, and inputs a value based on the first random number included in the terminal response signal. It is characterized by checking a value based on a first random number by comparing it with a large number of outputs of the multivalued function.

【0048】

Further, in the present invention (claim 17), the terminal response means uses the first random number itself as a value based on the first random number.

【0049】

Further, in the present invention (claim 18), the key delivery means encrypts an encryption key using a value based on a first random number included in a terminal response signal and a second random number to generate a key delivery signal. However, each terminal is characterized in that an encryption key is obtained by decrypting a key delivery signal using a value based on the first random number obtained by each terminal and a second random number included in the terminal check signal. And.

【0050】

Further, in the present invention (claim 19), the key delivery means is the first random number included in the key request signal, the second random number generated in the key center, or the second random number included in the terminal response signal. An encryption key is encrypted using either a value based on one random number to generate a key delivery signal, and each terminal is either the first random number generated by each terminal or the first random number included in the terminal check signal. It is characterized in that an encryption key is obtained by decoding a key delivery signal using either a second random number or a value based on the first random number obtained by each terminal.

【0051】

Further, the present invention (claim 20) is a system including a key center having an encryption key to be delivered and a plurality of terminals connected to the key center via a public line, and each terminal. Sends the key request signal to the key center, receives the terminal check signal from the key center in response to the key request signal, transmits the terminal response signal to the key center in response to the terminal check signal, and sends the key in response to the terminal response signal. A means for receiving a delivery signal from the key center, a means for generating a first random number, a means for generating a key request signal including the first random number and indicating an encryption key required for each terminal, and a means for receiving the delivery signal from the key center. A terminal response including a means for obtaining a second random number from the terminal check signal, a means for obtaining a value based on the first random number, a value based on the first random number, and a second random number included in the terminal check signal. The key center receives a key request signal from each terminal and sends a terminal check signal according to the key request signal, including a means for generating a signal and a means for obtaining an encryption key from a key delivery means received from the key center. The first means from the means of transmitting to the terminal, receiving the terminal response signal from each terminal in response to the terminal check signal, and transmitting the key delivery signal to each terminal in response to the terminal response signal, and the key requesting means received from each terminal. A means for obtaining a random number, a means for generating a second random number, a means for generating a terminal check signal containing the second random number, and a value based on the first random number from the terminal response signal received from each terminal. And the means for obtaining the second random number, and the value based on the first random number and the second random number included in the terminal response signal are included in the second random number and the key request signal generated at the key center. Only when the means for confirming the validity of access from each terminal by checking based on the first random number and the means for confirming the validity of access from each terminal are confirmed by the key request signal Provided is a means for generating a key delivery signal including the encrypted key, and an encryption key delivery system including the key delivery signal.

【0052】

[Action]

According to the present invention, since random numbers are generated at both the terminal and the key center, the signal between the key center and the terminal can be changed at each connection, and the random numbers generated at the key center are encrypted. By correctly decrypting and sending back on the terminal side, it is possible to check whether the terminal is spoofing. Furthermore, by inputting a random number on the terminal side into the multivalued function, the signal between the key center and the terminal can be prevented from being fixed even if the random number source is fixed, and the processing content of the terminal program can be analyzed. To do so, it becomes difficult to construct a block diagram of the program.

【0053】

Therefore, when delivering the key from the key center to the terminal, the key is hidden against the interception of the intermediate line by a malicious terminal user, and the interception result is unlikely to be a hint against the alteration of the terminal program, so that the dummy key It becomes difficult to spoof the center or dummy terminal.

【0054】

[Example]

Hereinafter, examples of the present invention will be described with reference to the drawings.

【0055】

FIG. 3 is a diagram showing an overall configuration of an encryption key delivery system according to an embodiment of the present invention. The encryption key delivery system shown in the figure has a key center 1 having an encryption key (hereinafter referred to as an AP key) and a large number of terminals 5 connected to the key center 1 via a public line 3. When the terminal 5 needs the AP key, it connects to the key center 1 via the public line 3 and receives the delivery of the AP key from the key center 1.

【0056】

As shown in FIG. 4, the terminal 5 includes a key management unit 51, a random number generator 52, a multi-value function unit 53, an encryption device 61, a decryption device 62, an encryption device 63, a decryption device 64, and a communication line control unit 65. As shown in FIG. 5, the key center 1 has a key management unit 11, a random number generator 12, a multi-value function unit 13, an AP key database 14, a decryption device 21, an encryption device 22, and a decryption device 23. , Cryptographic device 24, and communication line control unit 25. The functions of these components will be described later.

【0057】

FIG. 6 shows a processing flow between the terminal 5 and the key center 1. The symbol E (X, Y) in FIG. 6 represents a signal in which X is encrypted using the key Y by the public key cryptosystem E, and E'(X, Y) is the private key cryptosystem E. It shall represent a signal in which X is encrypted using the key Y by'. It is assumed that the terminal 5 holds the public key K2e.

【0058】

Next, the processing flow of this embodiment will be described with reference to FIG. 6 according to the flowchart shown in FIG. In the flowchart of FIG. 7, the process enclosed in the double frame indicates the process in the key center 1, and the process enclosed in the single frame indicates the process in the terminal 5.

【0059】

First, in the initial state, the terminal 5 stores the public key K2e in the key management unit 51 (step 501), the key center 1 stores the private key K2d corresponding to the public key K2e in the key management unit 11, and the terminal 5 The AP key to be sent to is stored in the AP key database 14 (step 502).

【0060】

When the terminal 5 needs an AP key, the random number generator 52 generates a random number K3, and the encryption device 61 encrypts the random number K2 using the public key K2e in the key management unit 51 to obtain the signal E (K3, K2e) is transmitted from the communication line control unit 65 to the key center 1 as an AP key request signal (step 503). At this time, the user authenticator (user ID, password, or both) is also encrypted and sent together with the random number K3 if necessary, but the transmission of this user authenticator may be omitted.

【0061】

Upon receiving the "AP key request signal", the key center 1 decodes the random number K3 at the decryption device 21 using the private key K2d in the key management unit 11. After that, the random number generator 12 generates a random number K4, and the encryption device 22 encrypts the random number K4 using the random number K3. The signal E'(K4, K3) obtained is used as a "terminal check signal" in the communication line control unit. Send from 25 to terminal 5 (step 504). It should be noted that the AP key for which AP the terminal is requesting is shown in the above "AP key request signal", and the key center 1 can recognize this.

【0062】

The terminal 5 that has received the "terminal check signal" decodes the random number K4 using the random number K3 in the decoding device 62. Furthermore, the random number K3 is input to the multivalued function unit 53, and any one of the outputs, K3', is obtained. After that, the signal E (K3'+ K4, K2e) obtained by encrypting the random numbers K4 and K3'with the public key K2e by the encryption device 63 is transmitted to the key center 1 as a "terminal response signal" (step 505). ).

【0063】

Upon receiving the "terminal response signal", the key center 1 decodes the random numbers K4 and K3'using the private key K2d at the decoding device 23 (step 506). After that, it is checked whether or not the decoded K4 matches the one previously generated by the random number generator 12 (step 507). Then, if they match, the random number K3 is input to the multivalued function unit 13, and it is checked whether or not K3'exists in the set of its outputs (step 508). If it exists, that is, if the two checks are satisfied, it is assumed that the access is from a legitimate terminal, the AP key K1 is taken out from the AP key database 14, and the random numbers K4 and K3'are used in the encryption device 24. The signal E'(K1, K3'+ K4) obtained by encryption is transmitted to the terminal 5 as an "AP key distribution signal" (step 509). At this time, if necessary, billing is also performed at the same time. If the check in steps 507 and 508 is not satisfied, the line is disconnected as an access from an illegal terminal (step 511).

【0064】

The terminal 5 that has received the "AP key distribution signal" decodes this with the decoding device 64 using the random numbers K4 and K3'to obtain the AP key K1 (step 510).

【0065】

Next, the effects of the above-mentioned examples of the present invention will be described.

【0066】

As already mentioned, in a situation where there is a possibility of spoofing by interception / recording of an intermediate line by a malicious terminal user, simply encrypting the signal on the line is not sufficient to prevent unauthorized use.

【0067】

The effect of the present invention is to prevent fraudulent billing due to terminal spoofing in line interception / recording, and semantic analysis of signals, which is a powerful and easy auxiliary means for program analysis of terminal programs.

【0068】

First, in a system that satisfies (Condition 1) to (Condition 3), it is assumed that a third party intends to illegally charge a certain terminal user by spoofing the terminal by wire interception / recording. That is, the terminal user normally uses the AP, and the third party intercepts and records the signal. Then, the third party transmits the output signal seen from the user side to the key center.

【0069】

However, in this embodiment, since there are two signal outputs for one AP use, these are transmitted in order, but since the key center side also generates a random number each time, the first Since the random numbers when the three parties recorded and the random numbers when trying to perform fraud are different, the key center can check that some fraud has been performed.

【0070】

Next, in a system in which (Condition 3) is satisfied but (Condition 1) and (Condition 2) are not completely satisfied, the terminal user who intends to analyze the meaning of the signal has several times the AP is normal (not illegal). Suppose you want to use it, intercept the signal flowing through the line, and try to examine it.

【0071】

However, in this embodiment, since the signal reciprocates twice, it is impossible to know which information is carried on which signal before the terminal program is analyzed because the signal is encrypted. .. Moreover, since (Condition 3) is satisfied, the signal itself cannot be decoded. Therefore, the meaning of the signal cannot be uniquely determined only by intercepting the line, and the difficulty of analyzing the terminal program cannot be reduced.

【0072】

Moreover, in this embodiment, K3'is generated by a multivalued function based on K3. As a result, K3'sent from the user terminal to the key center for the second time is not completely dependent on K3 and is not uniquely determined. Therefore, K3 is fixed in some way and E (K4, K3) is recorded. Even if it is fixed, the terminal response signal E (K3'+ K4, K2e) output by the terminal program for the second time is not fixed. On the other hand, since the key center has the same multivalued function, it is possible to check whether K3'obtained from the received E (K3'+ K4, K2e) is generated by K3, so the other party can check. It can be confirmed that the terminal program of is originally distributed.

【0073】

Here, the multivalued function is a function that outputs a plurality of fixed values for one input, and if the same value is input, the set of output values always matches. For example, it is conceivable to use a function F that associates a set of all numbers r ́ (0 r ́ 9999) such that r with a remainder N = 100 for a certain number r (0 r 99). ..

【0074】

When this function F is applied to this embodiment, r = K3 and r ́ = K3'may be set. As an example, when r = 38, the output of the multivalued function is F (38) = {38,138, ..., 9938}. Since the terminal only needs to send one of these to the key center, it is sufficient to actually take the random number R (0 R 99) and calculate r ́ = 100R + r. For example, if R = 22, r ́ = 2238 = (100 × 22) +38 is transmitted.

【0075】

The key center side should calculate the transmitted r ́ with mod100, compare it with the previously transmitted r, and check whether r = r ́. In fact, if r ́ = 2238 is received from the terminal, then r ́ = 2238 = 38 (mod 100), so it can be confirmed that r ́ = r ́ is compared with r = 38 that has been received in advance.

【0076】

The above-described embodiment can also be modified as follows. That is, various modifications can be made by changing the information used as the key for encryption and the information to be encrypted.

【0077】

In particular, after both the key center and the user terminal share the same key information, communication can be performed using the private key encryption method in which the encryption key and the decryption key are the same. Therefore, the final AP key in FIG. In the "delivery signal", when K1 is encrypted and transmitted from the key center to the user terminal, it is possible to use only K3', only K4, or only K3 instead of K3'+ K4 as the encryption key. .. For example, as shown in FIG. 8, a modified example in which K3'is used as an encryption key instead of K3'+ K4 used for the "AP key distribution signal" in FIG. 6 is possible. The same is possible when using only K4 or only K3.

【0078】

On the other hand, for the program running on the terminal, a method other than the multivalued function can be used to confirm that the program is expected to be accessed by the key center side.

【0079】

For example, it is conceivable to embed some secret character string in the terminal program and return the character string to the key center side to confirm this.

【0080】

In such a case, K3', which is the output of the multivalued function in Fig. 6, is naturally unnecessary, so K3 can be used as it is as shown in Fig. 9 instead of K3' in Fig. 6.

【0081】

Further, a modification can be made by changing the combination of the public key cryptosystem E and the private key cryptosystem E ́ used to encrypt the signal between the key center 1 and the user terminal 5.

【0082】

For example, if the encryption / decryption speed of the private key encryption method E ́ is faster than that of the public key encryption method E, as shown in FIG. 10, the terminal response signal E encrypted in FIG. 6 ( A private key whose key is a random number K4 that obtains the encrypted terminal response signal E ́ (K3'+ K4, K4) from the public key encryption method E used to obtain K3'+ K4, K2e). Instead of encryption method E ́, only the AP key request signal first sent from user terminal 5 to key center 1 is encrypted with public key encryption method E, and all subsequent signals are encrypted with private key encryption method E ́. You may try to do it. In this case, as shown in FIG. 10, it is no longer necessary to supply the public key K2e to the encryption device 63 on the user terminal 5 side, while on the key center 1 side, instead of supplying the private key K2d to the decryption device 23, the key center 1 The random number K4 generated in is supplied.

【0083】

Next, an example of a software sales system using the encryption key delivery method of the present invention described in the above embodiment will be described.

【0084】

In this software sales system, the software for sale is encrypted and stored on a CD-ROM. The user who purchased the CD-ROM attaches the CD-ROM to his / her terminal and selects the software he / she wants to purchase. After selection, the user can call the key center from the terminal via a modem, receive the key for decrypting the software in exchange for payment, and decrypt and use the software.

【0085】

FIG. 10 is a block diagram showing the configuration of such a software sales system. In FIG. 10, the user's terminal 44 and the key center 45 are connected by a public line. In addition, the terminal 42 of the CD-ROM manufacturer and the key center 45 are connected by a LAN or a public line. Paid information is provided to the CD-ROM manufacturer terminal 42 by the information provider 41, and the CD-ROM manufacturer terminal 42 distributes the CD-ROM 43 in which the paid information is encrypted to the market.

【0086】

FIG. 11 shows the configuration of the CD-ROM manufacturer terminal 42. The CD-ROM manufacturer terminal 42 is composed of an encryption device 47 and a CD-ROM manufacturer terminal 48 . The encryption device 47 encrypts the paid information software received from the information provider (IP) 41 using a separate AP key K1 for each software. At this time, each software is given a unique identification number ID. The key center 45 manages the information indicating the correspondence between the identification number for each software and the AP key. The CD-ROM manufacturing device 48 launches the encrypted software that is the output of the encryption device 47 and the public key K2e generated by the key center 45 together with a sales information program that activates the software to be purchased by the user. Save to one CD-ROM.

【0087】

Next, the procedure for creating a CD-ROM will be described in more detail.

【0088】

When the information provider (IP) 41 gives the software to be sold to the CD-ROM manufacturer, the CD-ROM manufacturer assigns an ID to the software received from the information provider 41 for each software.

【0089】

Then, each software is encrypted with a separate AP key K1 for each ID and saved on the CD-ROM43 (here, although there are actually multiple AP keys, they are represented by the same code K1 for convenience. ). At the same time, the CD-ROM manufacturer creates a correspondence table between the ID and AP key for each software. The created CD-ROM43 is distributed to the market, and the correspondence table is sent to the key center 45.

【0090】

Next, the procedure for purchasing the software stored in the distributed CD-ROM 43 as described above will be specifically described.

【0091】

The user of the terminal 44 purchases the CD-ROM 43 generated as described above, and attaches the CD-ROM 43 to the CD-ROM system in the terminal 44 owned by the user. Then, the user starts the sales information program saved on the CD-ROM43 and selects the software to be purchased (internally, the software ID is selected). When the software is selected, the terminal 44 connects to the key center 45 via a modem through a public line.

【0092】

Then, the terminal 44 obtains the AP key K1 from the key center 45 as described above, reads the software encrypted by the CD-ROM system, and decrypts it. In this example, the ID of the software selected by the user is encrypted together with the random number K3 by the encryption device 61 of the terminal in FIG. 4 using the public key K2e, and transmitted to the key center 45 as an AP key request signal. At the key center 45, the corresponding AP key K1 is searched from the AP key database 14 of FIG. 5 using the software ID obtained by decoding the "AP key request signal" as a key, and the result is shown in FIG. It is passed to the user's terminal 44 and charged to the user according to the procedure shown.

【0093】

[Effect of the invention]

As described above, according to the present invention, since random numbers are generated at both the terminal and the key center, the signal between the key center and the terminal can be changed at each connection, and is generated at the key center. By encrypting the random numbers, decoding them correctly on the terminal side, and sending them back, it is possible to check whether the terminal is spoofing. Furthermore, by inputting a random number on the terminal side into the multivalued function, the signal between the key center and the terminal can be prevented from being fixed even if the random number source is fixed, and the processing content of the terminal program can be analyzed. To do so, it becomes difficult to construct a block diagram of the program.

【0094】

Therefore, when delivering the key from the key center to the terminal, the key is hidden against the interception of the intermediate line by a malicious terminal user, and the interception result is unlikely to be a hint against the alteration of the terminal program, so that the dummy key It becomes difficult to spoof the center or dummy terminal.

[Simple explanation of drawings]

[Figure 1]

It is a chart which shows the flow of processing between a terminal and a key center in an example of a conventional encryption key delivery method.

[Figure 2]

It is a chart which shows the flow of processing between a terminal and a key center in another example of the conventional encryption key delivery method.

[Fig. 3]

It is a schematic block diagram which shows the whole structure of one Example of the encryption key delivery system by this invention.

[Fig. 4]

It is a block diagram which shows the structure of the terminal in the said Example.

[Fig. 5]

It is a block diagram which shows the structure of the key center in the said Example.

[Fig. 6]

It is a chart which shows the flow of processing between a terminal and a key center in the said Example.

[Fig. 7]

It is a flowchart which shows the operation of the terminal and the key center in the said Example.

[Fig. 8]

It is a chart which shows the flow of processing between a terminal and a key center in one modification of the said Example.

[Fig. 9]

It is a chart which shows the flow of processing between a terminal and a key center in another modification of the said Example.

[Fig. 10]

It is a chart which shows the outflow of processing between a terminal and a key center in another modification of the said Example.

[Fig. 11]

It is a block diagram of the software sales system using the encryption key delivery method by this invention.

[Fig. 12]

It is a block diagram which shows the structure of the CD-ROM maker terminal used in the software sales system of FIG.

[Explanation of symbols]

1 Key center 3 public line 5 terminals 11,51 Key Management Department 12,52 Random number generator 13,53 Multivalued function part 14 AP key database 21,23,62,64 Decryptor 22,24,61,63 Cryptographic device 25,65 Communication line control unit