JP2000354031A - Common key sharing method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To omit the verification processing of a public key certificate, when a common key is shared and also to secure the safety for the cipher communication by generating the verification data from the common key that is decoded by a 1st information terminal and a public key and also generating the verification data from the common key that is held by a 2nd information terminal and the public key. SOLUTION: A call is made from an information terminal A to an information terminal B. The terminal A has a public key A and a secret key A that is corresponding to the public key A and sends this key A to the terminal B. The terminal B generates a common key, generates a hash from the data where the common key is connected to the public key A and shows the has at a display part. Then the common key is enciphered by the public key A and transmitted to the terminal A. Receiving the enciphered common key, the terminal A generates a hash from the data, where the received common key is connected to its own public key A and shows the hash at the display part. The users A and B confirm the matching of display between their information terminals in voices and then enciphers these voices via the common key to perform the cipher communication.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a common key sharing method for securely sharing a common key for encrypted communication between information terminals.

[0002]

2. Description of the Related Art Conventionally, when cryptographic communication is realized between two information terminals A and B, for example, a common key generated by the information terminal A is transmitted to the information terminal B using a public key cryptosystem and shared. In this case, the data exchanged alternately with the shared common key is encrypted to perform the encryption communication of the common key system. In this method, when the common key is shared, the common key is encrypted with the public key of the information terminal B. Therefore, it is necessary to maintain the reliability that this public key is definitely the public key of the information terminal B. Yes, this public key is authenticated by a public key certificate issuing authority, which is a trusted third party, and is in the form of a public key certificate. Hereinafter, FIG.
A conventional common key sharing method will be described with reference to FIG.
FIG. 119 is a diagram of a conventional cryptographic communication system, FIG. 120 is a flowchart of the operation of the conventional cryptographic communication system, and FIG.
1 is, for example, Nikkei Communication separate volume "Latest Internet Technology" (April 25, 1996, Nikkei BP
FIG. 17 is a diagram illustrating a method of sharing a common key in the conventional cryptographic communication system described on pages 172 to 178 of the company.

[0005] Information terminals A8501 and B8502 that perform encrypted communication store the public key (public key CA) of public key certificate issuing authority 8503 in CA public key storage units 8502 and 8515, respectively, prior to the encrypted communication. Keep it. Next, the information terminals A and B issue public key certificates that certify that their respective public keys (public keys A and B) are public keys issued by the respective information terminals. Issued by Issuing Bureau 8503. Therefore, first, a key pair, which is a pair of a secret key and a public key, is generated by the key pair generation unit 8.
505 and 8525, the respective public keys (public key A and public key B) are included in the certificate issuance request and transmitted to the public key certificate issuing authority 8503. Upon receiving this, the public key certificate issuing authority 8503 converts the public key into the form of a public key with a certificate by the certificate issuing unit 8527, and stores it in the certificate storage unit 8528 (see FIG. 121). The secret keys (secret keys A and B) of the information terminals A and B are stored in respective secret key storage units 8503,
8516.

[0004] Next, information terminal A8501 and information terminal B8
FIG. 120 and FIG.
This will be described with reference to FIG. Prior to the detailed description, the outline will be described with reference to (a1) to (b2) of FIG. (A1)-(b2) briefly describe the contents of each step on the left, (a1)-(a3) show the operation of the information terminal A, (b1) and (b2) show the operation of the information terminal B It is. First, the information terminal A generates a common key (a1), and inserts its own signature in this to clarify the generation source. The secret key A is used for this (a2). Next, in order to transmit to the information terminal B by the public key cryptosystem, the data is encrypted with the public key B (a3) and transmitted. The information terminal B receiving this decrypts it with its own secret key B (b1). Next, the signature is verified with the public key A of the information terminal A in order to confirm that the signature attached to the decrypted common key is of the information terminal A (b2). If it can be verified, this secret key is reliable.

In (a3) and (b2), the public keys B and A are used. In order to confirm that the public keys belong to the information terminals B and A, the public key certificate issuing authority 85
03 (S8703, S8709),
Further, in order to confirm that the certificate is definitely issued by the public key certificate issuing authority, verification is performed using the public key CA of the public key certificate issuing authority (S8704, S871).
Step 0). This is because the certificate is digitally signed by the public key certificate issuing authority using the secret key (private key CA) of the public key certificate issuing authority.

The following is a more detailed description of (1) and (2). (1) Operation of Information Terminal A In the information terminal A 8501, the common key generation unit 8506 generates a common key (S8701). A signature is generated for the generated common key using its own secret key A stored in the secret key storage unit 8503, and the signature is added to the common key (S8702). The certificate acquiring unit 8510 sends a certificate acquisition request of the information terminal B to the public key certificate issuing authority 8503.
Send to The certificate acquisition request is sent to the certificate search unit 8529 via the transmission unit 8507, the transmission path 8531, and the reception unit 8526 of the public key certificate issuing authority. In the certificate search unit, the certificate of the information terminal 2 is searched from the certificate storage unit 8528, and the certificate obtained as a search result is stored in the certificate response unit 8
From 530, it transmits to the information terminal A8501. The certificate of the information terminal B returned as a response is sent to the certificate acquisition unit 8510 via the transmission unit 8525, the transmission path 8531, and the reception unit 8508 of the information terminal A (S8703). The certificate verifying unit 8511 verifies the certificate of the information terminal B acquired in step S8703 using the public key of the public key certificate issuing authority 8503 stored in the CA public key storage unit 8502 (S8704). If the verification fails, the processing is interrupted. If the verification is successful, the public key B included in the certificate
By using the signed common key encryption unit 8512
Encrypt the signed common key generated in 702 (S87)
05). The encrypted signed common key is transmitted to the transmitting unit 850.
7 is sent to the transmission path 8528 to the information terminal B8502 (S8706).

(2) Operation of Information Terminal B When the receiving unit 8518 receives the encrypted signed common key by the receiving unit 8518 (S 8707), the information terminal B 8502 stored in the secret key storage unit 8516 The encrypted common key with signature is decrypted by the common key decryption unit 8519 using the secret key (S8708). Next, in order to verify the signature of the signed common key, step S870 is performed.
9, the certificate of the public key A is sent to the public key certificate issuing authority 85
Obtain from 03. For this purpose, the information terminal B first transmits a certificate acquisition request for the information terminal A to the public key certificate issuing authority 8503 by the certificate acquisition unit 8520. The certificate acquisition request is sent to the certificate search unit 8529 via the transmission unit 8517, the transmission path 8525, and the reception unit 8526 of the public key certificate issuing authority 8503. The certificate search unit 8529 searches the certificate of the information terminal A from the certificate storage unit 8525,
The certificate obtained as a search result is sent to the certificate response unit 8530.
To the information terminal B. The certificate of the information terminal A returned as a response is transmitted by the transmitting unit 8525, the transmission path 8528,
The data is sent to the certificate obtaining unit 8520 via the receiving unit 8518 (S8709). The certificate verification unit 8521 verifies the certificate of the information terminal A acquired in step S8709 using the public key of the public key certificate issuing authority 8503 stored in the CA public key storage unit 8515 (S8710). If the verification fails, the processing is interrupted. If the verification is successful, the signed common key is
Verification is performed by the common key signature verification unit 8521 (S871)
1). At this point, the information terminal B can confirm that the common key created by the information terminal A has been obtained without eavesdropping or tampering, and stores the received common key in the common key storage unit 8527 (S8712).

[0008] Thereafter, the information terminal A8501 and the information terminal B85
No. 02 performs cipher communication using the shared common key as the common key of the common key cryptosystem. That is, information terminal B8502
The data encrypted by the data encryption unit 8524 with the common key is transmitted by the transmission unit 8517 and the transmission path 852.
8. The data decoding unit 8 via the receiving unit 8508 of the information terminal A
514 and decrypted with the shared common key. Also,
The data encrypted by the data encryption unit 8513 of the information terminal A8501 using the common key is transmitted to the transmission unit 850.
7. The data is transmitted to the data decrypting unit 8523 via the transmission path 8528 and the receiving unit 8518 of the information terminal B, and is decrypted with the shared common key.

As a second conventional example in which a common key is simply shared without a certificate issued by a certificate issuing authority and communication is performed using a secret key, an electronic contract method disclosed in Japanese Patent Application Laid-Open No. H10-240826 is known. is there. In summary, this method shares a common key algorithm, and one party user A processes his or her own identifier into a common key using the common key algorithm. Then, the data is encrypted using the generated common key and sent to the other party user B. The user B decrypts the encrypted data using the identifier of the user A obtained in advance and the common key generated from the common key algorithm to decrypt the data. on the other hand,
The user B encrypts a certain random number with the common key and sends it to the user A. The received user A obtains a random number by decrypting with the common key. Further, the user A obtains a hash value determined by the secret key of the user A from the data. And user A
Encrypts the hash value and the data with the random number sent from the user B as a key and sends the encrypted value to the user B. The user B obtains a hash value and data from the user A by decoding using the random number. This can be collated and confirmed with the decrypted data obtained earlier. At this time, the hash value depends on data sent from the user A to the user B, and is a value unique to the user A. As described above, the hash value depends on the data sent by the user A using his / her own secret key, and the confidentiality is confirmed by two communications using the common key.

[0010] Similarly, as another simple secret communication without a certificate from a public certificate issuing authority, a secret information communication method and apparatus disclosed in Japanese Patent Laid-Open No. 6-244832, which is a third conventional example, is disclosed. is there. In summary, this method and apparatus have each other transmit a public key and transmit data encrypted using the public key to the other party. On the other hand, the hash value of the public key received from each other is calculated, and the calculated hash value is compared with a hash value given in advance, and the correctness of the sent public key is verified. However, both the second conventional example and the third conventional example are secret communication based on a common key system, and there is concern about confidentiality.
In addition, the hash value simply guarantees creation by one side,
It merely indicates that a public key (or a common key) is used, and does not guarantee further data.

[0011]

As described above, in order for the information terminals A and B to share a common key with a correct partner using the public key cryptosystem, (1) the public key of the information terminal B A means by which the information terminal A can confirm that B is really the information terminal B and (2) a means by which the information terminal B can confirm that the public key A of the information terminal A really belongs to the information terminal A are required It is. To realize the above two means only by exchanging data via the information communication network in a state where the voice and face of the other party are not visible, a public key certificate issuing authority, which is a trusted third party, needs information terminal A, B has public key A and public key B issue public key certificates to prove that they are their own public keys, and obtain and verify each other's public key certificates during cryptographic communication. Is required.

[0012] However, the public key certificate issuance process involves many steps, and the operation of the information terminal user becomes complicated. In addition, there is a problem that the verification process of the public key certificate takes time, and the size of software and hardware for realizing the verification process of the public key certificate increases. And
If the verification process of the public key certificate is not performed to solve this problem, there arises a problem that the reliability of the public key cannot be maintained and the security of the encrypted communication cannot be ensured.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problem. A common key sharing method which does not require a public key certificate verification process when sharing a common key and which can ensure the security of encrypted communication. The purpose is to obtain.

Further, the present invention relates to Diffie-Hell
It is an object of the present invention to obtain a common key sharing method that can confirm that a common key has been correctly shared with a correct partner when the common key is shared by the man method.

Another object of the present invention is to provide a common key sharing method which can easily confirm that a common key has been correctly shared with a correct partner when the common key is shared.

[0016]

According to a first aspect of the present invention, there is provided a common key sharing method including a data communication unit and a voice communication unit.
A method of sharing a common key between information terminals performing cryptographic communication using a common key method, wherein a first information terminal having a secret key and a corresponding public key is The operation for obtaining the held cryptographic communication common key includes the following steps. (1) a public key transmitting step in which the first information terminal transmits the public key to the second information terminal by data communication means; (2) the first information terminal receives the first key A common key transmitting step of encrypting the held common key using a public key of the information terminal, and transmitting the encrypted common key to the first information terminal by data communication means; One information terminal decrypts the received encrypted common key with the secret key of the first information terminal, and obtains first verification data from the decrypted common key and the public key of the first information terminal. (4) The second information terminal generates second verification data from the held common key and the public key of the first information terminal. Verification data generation step; (5) the above first and second information A verification data comparing step in which a terminal user mutually confirms each other by voice through the voice communication means, and further compares the first verification data and the second verification data with each other by voice.

A common key sharing method according to a second aspect of the present invention is a method for sharing a common key between information terminals having data communication means and voice communication means and performing cryptographic communication using a common key method. It is a thing containing. (1) a common key sharing step in which the first and second information terminals performing mutual cryptographic communication share a common key for cryptographic communication by the Diffie-Hellman method via the data communication means when performing cryptographic communication; 2) a verification data generation step in which the first and second information terminals respectively generate first verification data and second verification data from the held common key; (3) the first and second information terminals A verification data comparing step in which a user of the information terminal mutually confirms each other by voice through the voice communication means, and further compares the first verification data and the second verification data by voice.

According to a third aspect of the present invention, there is provided a common key sharing method comprising:
In the second invention, the first verification data and the second verification data are hashes generated by a predetermined procedure.

A common key sharing method according to a fourth aspect of the present invention
In the invention, the first and second information terminals have a display unit for displaying at least a part of the hash, and in the verification data comparison step, each user compares the displayed hash. Things.

[0020] A common key sharing method according to a fifth aspect of the present invention provides the common key sharing method according to the first aspect.
And in the second invention, the first and second information terminals have a verification data conversion table for associating a given numerical value with a specific character, graphic, or moving image, and the first verification data and the second verification data Is a character, a graphic, or a moving image in which the hash value generated in a predetermined procedure is associated with the verification data conversion table.

According to a sixth aspect of the present invention, there is provided a common key sharing method comprising:
And in the second invention, the first and second information terminals have a verification data conversion table for associating a given numerical value with a specific sound, and the first verification data and the second verification data Is a sound in which the hash value generated in the above procedure is associated with the verification data conversion table.

Still further, a timer is provided, and a warning is issued when a verification data comparison step of comparing the first verification data with the second verification data exceeds a set time of the timer.

The information terminal in the claims may be a device in which voice communication means and data communication means are integrated, or a personal computer connected by a telephone as voice communication means and a network as data communication means. It may be realized by using together.

[0024]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Embodiment 1 Embodiment 1 will be described with reference to FIGS. 1 to 9. In the present embodiment, an example will be described in which two information terminals share a common key and then encrypt each other's voice with the common key to perform encrypted communication. This common key is generated by one information terminal and sent to the other information terminal by a public key method. FIG. 1 is a system configuration diagram of the present embodiment, and FIGS.
FIG. 4 is a diagram for explaining an outline of the operation of this embodiment, FIG. 4 is a flowchart showing the operation of this embodiment, FIG. 5 is an explanatory diagram of a hash generation method in this embodiment, and FIG. FIG. 7 is an explanatory diagram of a generation method, FIG. 7 is an explanatory diagram of data transmission when secret security is not ensured, FIG. It is a figure of the information terminal provided with the scroll button.

The configuration will be described. In FIG. 1, 1 is an information terminal A, 2 is an information terminal B, and 3 is a relay station for relaying communication between the information terminal A1 and the information terminal B2.
The information terminal A1 and the information terminal B2 are connected by a data transmission line 4 and a voice transmission line 5, respectively. This communication path 4 may be wired or wireless. Information terminal A
1 and the information terminal B2 transmit data information such as an encryption key and encrypted data in the cryptographic communication through the data transmission path 4 to mutually perform cryptographic communication, and mutually transmit voice information through the voice transmission path 5.

Hereinafter, the configuration of the information terminal A1 will be described. 1
01 is a user input unit such as a numeric keypad for a user to input data, 102 is a voice input / output unit including a microphone and a speaker, 103 is a display unit including a liquid crystal display device, etc.
Reference numeral 104 denotes a user confirmation input unit, which includes push buttons that the user presses at the start and end of the encrypted communication. 105 is a hash generation unit that generates a hash from given data, 106 is a voice encryption unit that encrypts voice, 107 is a voice decryption unit that decrypts encrypted voice, and 108 is information terminal A1 that stores other information. A transmission / reception unit for communicating with the terminal, a key pair generation unit 109 for generating a pair of a public key and a secret key in a public key cryptosystem, and a storage unit 110 for storing the secret key generated by the key pair generation unit 109 A secret key storage unit 111 is a common key decryption unit that decrypts the encrypted common key of the common key cryptosystem, and a reference numeral 112 is a common key storage unit that stores the common key decrypted by the common key decryption unit 111.

Next, the configuration of the information terminal B2 will be described.
201 to 208 have the same functions as 101 to 108 in the information terminal A1, respectively, 201 is a user input unit, 202 is a voice input / output unit, 203 is a display unit,
204 is a user confirmation input unit, 205 is a hash generation unit,
Reference numeral 206 denotes a voice encryption unit, 207 denotes a voice decoding unit, and 208 denotes a transmission / reception unit. Reference numeral 209 denotes a common key generation unit that generates a common key used when performing cryptographic communication using the common key method, has a random number generation unit (not shown), and generates a common key from the random number generated by the random number generation unit. Reference numeral 210 denotes a common key storage unit that stores the common key generated by the common key generation unit 209, 211 denotes a public key storage unit that stores a public key used when performing cryptographic communication by a public key method, and 212 denotes a public key storage unit. This is a common key encryption unit that encrypts the common key stored in the common key storage unit 210 with the public key stored in the public key storage unit 211. The data communication path in the present invention is formed by the data transmission path 4, the transmission / reception section 108 of the information terminal A1, and the transmission / reception section 208 of the information terminal B2, and the voice transmission path 5, the voice input / output section 102 of the information terminal A1, and the transmission / reception section 108 The voice input / output unit 202 and the transmission / reception unit 208 of the information terminal B2 form a voice communication unit in the present invention.

The above information terminal A1 and information terminal B2
Are the user input units 101 and 201 and the voice input / output unit 10
2, 202 and the display units 103 and 203 also function as a normal telephone.

The hash generation method in the hash generation units 105 and 205 includes “SHA1” or “MD
Although a method called “5” is well known, it is an operation method for converting variable-length data into fixed-length data. A fixed-length hash is uniquely determined for variable-length data, and a generated hash It is one-way that it is difficult to restore the original data from

Next, the operation will be described. The users of the information terminal A1 and the information terminal B2 will be referred to as a user A and a user B, respectively, and it is assumed that the users A and B can correctly recognize each other by telephone calls. In the following, a procedure for making a call from user A to user B and performing communication by mutually encrypting voices using a common key method will be described. It is necessary to share a key, and the common key generated by the information terminal B2 is encrypted with the public key of the information terminal A1, sent to the information terminal A1, and then encrypted communication is performed. To help understanding,
First, a schematic procedure will be described with reference to FIGS.

In FIG. 2A, first, a call is made from the information terminal A to the information terminal B. The information terminal A has a public key A and a corresponding secret key A, and sends the public key A to the information terminal B. In FIG. 2B, when receiving a call from the information terminal A, the information terminal B generates (1) a common key,
(2) A hash is generated from the data obtained by combining the common key and the public key A, and the hexadecimal representation of the upper two bytes is displayed on the display unit. (3) Further, the common key is encrypted with the public key A and (4) transmitted to the information terminal A. The information terminal A that has received the encrypted common key decrypts the encrypted common key with its own secret key A, and (6) combines the decrypted common key with its own public key A. , And a hexadecimal representation of the upper two bytes is displayed on the display unit. In FIG. 3, (1) the user A and the user B confirm by voice that the display of each information terminal matches, and (2) if the match is confirmed, the user A and the user B use the above-mentioned common key to reproduce the voice. Encrypt and perform encrypted communication.

Hereinafter, the detailed operation will be described in the following (1) to (4) with reference to the flowchart of FIG. (1) Operation of Information Terminal A (S101 to S105) First, when the user A specifies the partner by inputting the telephone number of the information terminal B2 from the user input unit 11 (S101), the key pair generation unit 109 of the information terminal A1 Upon activation, a secret key of the information terminal A1 and a corresponding public key are generated (S102),
This secret key is stored in the secret key storage unit 110 (S10
3). It is assumed that each of the secret key and the public key is, for example, 16 bytes. When the line from the information terminal A1 to the information terminal B2 is connected (S104), the information terminal A1 transmits a public key to the information terminal B2 (S105). Step S above
105 is a public key transmission step in the present invention.

(2) Operation of information terminal B (S106 to S1)
13) Upon receiving the public key of the information terminal A1 (S106), the information terminal B2 stores this public key in the public key storage unit 21 (S106).
107). Next, the information terminal B2 generates a common key by the common key generation unit 209 (S108), and the common key storage unit 210
(S109). This common key is assumed to be, for example, 16 bytes. Next, as shown in FIG. 5A, the generated common key and the public key of the information terminal A1 are combined to generate combined data, and a hash is generated from the combined data (S110). This hash is, for example, 20 bytes and is the second verification data in the present invention. Next, a predetermined number of bytes, for example, 2 bytes, at the head of the hash value is converted into a hexadecimal number and displayed on the display unit (S111). The display unit displays numbers or four alphabetical characters from A to F. Further, the common key is encrypted with the public key of the information terminal A1 (S112) and transmitted to the information terminal A1 (S113). Step S110 is the second verification data generation step in the present invention, and steps S112 and S1
Thirteenth is a common key transmission step in the present invention. The timing at which steps S110 and S111 are executed is not limited to the above. For example, an operation step S1 of the information terminal A described later is performed.
After 18, etc.

(3) Operation of information terminal A (S114 to S1)
18) Receive the encrypted common key from the information terminal B2 (S1)
14), and decrypts it with the secret key of the information terminal A1 (S115), and stores the decrypted common key in the common key storage unit 112.
(S116). FIG. 5 shows the decrypted common key.
As shown in (b), the data is combined with the public key of the information terminal A1 to generate combined data, and a 20-byte hash is generated from the combined data (S117). This hash is the first verification data in the present invention. Then, the first two bytes of the hash value are converted into hexadecimal numbers and displayed on the display unit (S118). Steps S115 and S1
17 is a first verification data generation step in the present invention.

The above operations from S101 to S118 are completed in a shorter time than the operation of making a telephone call by the user. Become.

(4) Operation of Information Terminals A and B (S119-
(S125) Subsequently, the user A and the user B confirm by voice that the first two bytes of the hash displayed on the respective information terminals match (S119). At this time, before confirming the hash by voice, it is confirmed by the voice of the other party that both parties are correct. Here, by confirming that the first two bytes of the hash match, if the first two bytes match, it is estimated that 20 bytes of the entire hash match. A match between the two hashes may be considered as a match between the combined data, and since the combined data is formed from a common key and a public key, the match between the combined data is the same. Proof that you have shared the key with the right person. Step S119 is a verification data comparison step in the present invention.

In steps S101 to S119, each information terminal is the same as a normal telephone in voice communication, and does not perform encryption and decryption processing in the information terminal.

Next, when the user A and the user B press the push buttons of the information terminals A1 and B2 and input them to the user confirmation input units 104 and 204 (S120),
Each information terminal enters an encryption communication mode for voice communication. When the encryption communication is started (S121), one user's voice input from the voice input / output units 102 and 202 is transmitted after being encrypted by the voice encryption units 106 and 206, and voice decryption of the other information terminal is performed. Encrypted communication is performed in which the audio data is decrypted by the units 207 and 107 and transmitted to the user from the audio input / output units 202 and 102 as normal audio (S1).
22). At this time, when the voice encrypting unit on the voice transmitting side encrypts the user's voice to generate a packet, it adds encryption identification information indicating that the voice is encrypted voice to the packet. The transmitting / receiving unit of the information terminal on the receiving side verifies the received packet, and upon detecting the encrypted identification information, notifies the voice decoding unit, and the voice decoding unit decodes the encrypted voice. When the conversation ends, the encryption communication ends when both users press the encryption communication buttons 104 and 204 again (S12).
3) Then, the common key storage units 112 and 210 of both information terminals
Is deleted (S124).

If the hash values do not match in S119, the common key cannot be normally shared, so the common key is deleted from the common key storage units 112 and 210 (S124), and the communication is terminated. (S125).

In the above example, as shown in FIG. 5A, the information terminal B2 generates combined data from the received public key of the information terminal A1 and the common key generated by itself, and generates a hash from the combined data. . Also, as shown in FIG. 5B, the information terminal A1 decrypts the common key encrypted and transmitted from the information terminal B2 and combines it with its own public key to generate combined data. Has been generated. Then, the user A and the user B compare the hashes generated by the respective information terminals with each other. This is because the information terminal B2 generates a hash only from the common key generated by itself and the information terminal A1 generates a hash only from the decrypted common key as shown in FIGS. This is because if the relay station 3 has malicious intent only by comparing the hashes generated by the respective information terminals with each other, the relay station 3 will be eavesdropped by the relay station 3 and the security of the encrypted communication cannot be ensured. The reason will be described below.

FIG. 7 shows a state of data exchange between the information terminal A1 and the information terminal B2 via the relay station 3. The relay station 3 has an intention of eavesdropping and holds its own public key and secret key. It is assumed that The communication procedure follows the flowchart of FIG. 4. When the information terminal A1 transmits the public key to the information terminal B2 in S105 (FIG. 7A), the relay station 3 that relays the public key discloses the information terminal A1. It is possible to replace the key with its own public key (FIG. 7 (b)) and transmit it to the information terminal B2 (FIG. 7 (c)). At this time, the relay station 3 stores the public key of the information terminal A1 to be relayed. The information terminal B2 receives the public key of the relay station 3 transmitted from the relay station 3 while misunderstanding the public key of the information terminal A1. Therefore, in step S113 of FIG. 4, the information terminal B2 transmits a common key encrypted with the public key of the relay station instead of the public key of the information terminal A1 (FIG. 7 (d)). It receives and decrypts it with its own secret key, and acquires a common key used by users A and B in encrypted communication (FIG. 7 (e)). Next, the relay station 3 encrypts this common key using the public key of the information terminal A1 stored earlier and transmits it to the information terminal A1 (FIG. 7 (f)). Therefore, the information terminal A1 can decrypt the encrypted common key with its own secret key, cannot detect that the common key has been stolen, and stores the decrypted common key in the common key storage unit 112. I do.

The hash value is generated from the common key decrypted by the information terminal A1, and the hash value is generated from the common key generated by the information terminal B2. When the user A and the user B compare the two in FIG. The two users enter a user confirmation input in S120, and start encrypted communication in S122. Thereafter, the information terminal A1 and the information terminal B2 perform cryptographic communication using the common key, but since the relay station 3 has acquired the common key, the relay station 3 eavesdrops on the communication between the information terminal A1 and the information terminal B2. It is possible.

As in the present embodiment described with reference to FIGS. 5A and 5B, the generated common key and the decrypted common key are stored in the information terminal A.
In the method of generating a hash from the combined data generated by combining with one public key, an operation when the relay station has maliciousness as described above will be described below. As described with reference to FIG. 7, the information terminal B2 receives the public key of the relay station 3 by misunderstanding that it is the public key of the information terminal A1, and as shown in FIG. The combined data is generated, and a hash is generated from the combined data. On the other hand, the information terminal A1 receives the common key encrypted with the public key of the information terminal A from the relay station, and decrypts the common key with its own secret key. Therefore, hash generation at the information terminal A1 is performed as shown in FIG.
It becomes the same as (b). When the relay station replaces the public key in this way, since the hash generated at the information terminal A1 and the hash generated at the information terminal B2 are different, the users A and B are displayed on the respective information terminals by voice. By comparing the obtained hashes, it is possible to detect the fraud of the relay station. At this time, since the probability that the first two bytes of the hash generated by the information terminal A1 and the hash generated by the information terminal B2 coincide with each other by chance is extremely low, only the head of the hash is displayed on the display unit and confirmed by voice. do it.

As the public key cryptosystem used for exchanging the common key between the information terminal A1 and the information terminal B2, an RSA system and an elliptic cryptosystem are well known. MISTY, FEAL, and the like are well known as a common key method used for performing encrypted communication between the information terminal A1 and the information terminal B2.

In the description of the configuration of the information terminal, the key pair generation unit 109, the secret key storage unit 110, the common key decryption unit 11
1 is possessed only by the information terminal A1, and the common key generation unit 209, the public key storage unit 211, and the common key encryption unit 212
However, this is to explain the operation when making a call from the information terminal A1 to the information terminal B2. In practice, the key pair generation unit 109, the secret key storage unit 110, and the The information terminal B2 also has the key decryption unit 111,
The information terminal A1 also includes a common key generation unit 209, a public key storage unit 211, and a common key encryption unit 212, and is configured to be capable of making mutual telephone calls and performing encrypted communication.

As described above, data such as a public key and a common key exchanged by the data transmission path are exposed to the risk of falsification and spoofing by the relay station during transmission. Similarly, the voice exchanged through the voice transmission path has the risk of falsification and spoofing, but since the voice is transmitted in real time, it is difficult to falsify the voice effectively. Speech is also very powerful as a means of authenticating the other party, making spoofing also difficult. According to the present embodiment, when performing cryptographic communication between the information terminal A and the information terminal B as described above, the information terminal A sends its public key to the information terminal B without certification of a third party, and the information terminal B A common key is generated and sent to the information terminal A after being encrypted with the public key of the information terminal A. The information terminal A decrypts the common key and its own public key, and the information terminal B generates the common key and the information terminal A Since the hash is generated from each public key and the matching of both hashes is confirmed by voice, it is easy to confirm that the correct common key has been shared with the correct partner.

When the information terminal A sends the public key,
Even if the public key A is not authenticated by the third party as the public key of the information terminal A, there is no danger of the common key being stolen and the cryptographic communication being eavesdropped. This has the effect of reducing the size of software and hardware. This effect is particularly remarkable in portable information terminals for individual users who are required to be reduced in size and price.

Further, since the information terminals A and B do not require any procedures before the information terminal A calls the information terminal B, the burden on the user is small and the scale of software and hardware is small. effective.

Also, the information terminal B generates a common key using a random number, and upon completion of the cryptographic communication, the common keys stored in the common key storage units 112 and 210 of both information terminals are deleted. Each time a different common key is used, there is an effect that the security is further improved as compared with a case where the same common key is repeatedly used.

In the above embodiment, an example is shown in which the first two bytes of the hash are displayed in hexadecimal.
The number of bytes to be displayed is not limited to this, and may be determined based on reliability, the size of the display unit, or the like. When only the first byte is displayed, even if the common key cannot be shared correctly, the probability of coincidence between both information terminals increases, and the reliability decreases, but the display unit may be small. In the case where three or more bytes are displayed, there is an effect that even if the common key cannot be correctly shared, the probability of coincidence coincidence between both information terminals is reduced and reliability is improved. If the number of digits to be displayed cannot be displayed on the display unit at one time, a scroll function of the display unit may be provided. In this case, all the hashes can be sequentially displayed. FIG. 9 shows an example in which a mobile phone type information terminal capable of displaying only 8 characters for 4 bytes on the display unit is provided with a scroll button for scrolling the display unit left and right.

Embodiment 2 Embodiment 2 will be described with reference to FIGS. In the first embodiment, an example has been described in which one information terminal generates a common key and sends the common key to the other information terminal by public key encryption to share the common key. In the present embodiment, the common key is shared without sending the common key.
The case of using the "ifieHellman method" (DH method) will be described. "Diffie Hellma
The "n method" is well known as a method of sharing a common key in a common key cryptosystem between two parties.

Referring to the drawings, FIG. 10 is a diagram showing the configuration of the present embodiment, FIG. 11 is a diagram for explaining generation of a common key in the present embodiment, FIG. 12 is a flowchart for explaining the operation of the present embodiment, and FIG. FIG. 3 is a diagram of hash generation in the present embodiment.

First, the configuration will be described. In FIG. 10, the same or corresponding components as those in FIG. In FIG. 10, 50
Reference numeral 1 denotes a common key generation unit of the information terminal A1;
A common key is generated with the common key generation unit 502 by the DH method. The users of the information terminal A1 and the information terminal B2 will be referred to as a user A and a user B, respectively.

Hereinafter, a case will be described in which a call is made from user A to user B and both parties share a common key by the DH method and then perform encrypted communication. This procedure is shown in FIG.
10, steps having the same functions as those in the flowchart of FIG. 2 described in Embodiment 1 in FIG. 10 are denoted by the same reference numerals.

First, the user A designates the other party by inputting the telephone number of the information terminal B2 from the user input section 11 (S10).
1) When a line is connected to the information terminal B2 (S1)
04), the common key generation units 501 and 502 of the information terminals A1 and B2 are activated, and generate and share a common key by the DH method (S401). Step S401 is a common key sharing step in the present invention.

The common key generation method in S401 will be described below with reference to FIG. In FIG. 12, a relay station is interposed between the information terminal A and the information terminal B, but is omitted. The DH method is a kind of the common key cryptosystem, but does not follow a procedure of generating a common key on one side and transmitting it to the other side by a public key cryptosystem as in MISTY or FEAL described in the first embodiment. First, the common key generation unit 501 of the information terminal A selects an integer G that satisfies the prime number P and 1 <G <P. Next, a secret random number R1 (integer) is generated, and G ^R1 mod P is calculated. Then, P, G, and G ^R1 mod P are transmitted to the information terminal B (FIG. 12A). These P, G, G ^R1 m
od P is not secret. Information terminal B receiving this
Generates a secret random number R2 (integer) in the common key generation unit 502, calculates G ^R2 mod P, and transmits this to the information terminal A (FIG. 12B). This G ^R2 mod P is also not secret. The information terminal A receiving this receives the G ^R2 m
od P is raised to the power R1, while the information terminal B is G ^R1 mod
Raise P to the square of R. Both calculation results are the same G ^R1 · ^R2 mo
dP, which is a common key shared by both terminals (FIG. 12 (c)). This common key is assumed to be, for example, 16 bytes.

The common keys generated and shared in S401 by the above procedure are stored in the respective common key storage units 107 and 20.
7 (S109). Thereafter, the information terminal A and the information terminal B perform voice encryption communication using the common key.
In the above S401, P, G, G ^R1 mod P, G ^R2 exchanged without secrecy between the information terminal A and the information terminal B
Calculating the common key from mod P becomes more difficult as G and P become larger, so that the security of encrypted communication is ensured.

On the other hand, since the DH method shares a common key in the above-described procedure, in the process of generating the common key, the other party is not authenticated as to whether or not it is communicating with the correct other party.
Then, after sharing the common key, it is confirmed that the correct partner is sharing the common key by voice in S110 and subsequent steps. S
At 110, the information terminals A and B generate the hash of the common key by the hash generation units 105 and 205. This hash is, for example, 2 as shown in FIG.
0 bytes. Then, the first two bytes of this hash value are converted into hexadecimal numbers, and the respective display units 103, 20
3 is displayed (S111). The above operation from S101 is completed in a shorter time than the operation of making a telephone call by the user, and four characters indicating the first two bytes of the hash are displayed on the display units of both information terminals. Step S110 is a verification data generation step in the present invention.

After S119, the process is the same as that of the first embodiment, and the user A and the user B confirm by voice that the first two bytes of the hash displayed on each information terminal match (S119). ). At this time, before confirming the hash by voice, it is confirmed by the voice of the other party that both parties are correct. Here, by confirming that the first two bytes of the hash match, if the first two bytes match, the entire hash has 2
It is estimated that 0 bytes match. When both hashes match, it is considered that the same common key could be shared with the correct partner, and the users A and B respectively press the push buttons of the information terminals A1 and B2 to encrypt the voice and perform encrypted communication. Step S119 is a verification data comparison step in the present invention.

The MISTY and FE described in the first embodiment
In common key cryptosystems such as AL, when sharing a common key, it is necessary to transmit the common key generated by one information terminal to the other using a public key system, and in this case it is released by a malicious relay station There was a risk that the key would be replaced. Therefore, the hash is generated from the common key and the public key as shown in FIGS. 5A and 5B. However, since the common key is not transmitted in the DH method, only the common key is used as shown in FIG. Can be generated from

As described above, in the present embodiment, DH
A common key is shared by a method, and a hash generated from the common key is compared by voice. Since the common key cannot be restored even if the hash is eavesdropped, the common key is not stolen. Therefore, it is possible to securely confirm that the same common key can be shared with the correct partner in the DH method with a simple device.

Embodiment 3 Embodiment 3 will be described with reference to FIGS. Embodiments 1 and 2 show an example in which two information terminals share a common key and then perform communication by encrypting voice with the common key. In the present embodiment, two personal computers (P
An example is shown in which a common key is shared between C), and after confirming that the correct common key has been shared with a correct partner by telephone, file data is encrypted with the common key and communication is performed. The personal computer connected by the network in the present embodiment is the data communication means of the present invention, the telephone connected by the telephone line in the present embodiment is the voice communication means of the present invention, and the combination of the telephone and the personal computer in the present embodiment is the book. 2 is an information terminal of the invention.

Referring to the drawings, FIG. 14 is a block diagram of the present embodiment, FIG. 15 is a diagram illustrating functional blocks of a personal computer in the present embodiment, and FIGS. FIG. 18 is a flowchart for explaining the operation of the present embodiment, and FIGS.
4 is a diagram illustrating an example of a display state of the display unit during operation of the present embodiment, and FIG. 20 is a diagram illustrating generation of a hash by a personal computer in the present embodiment.

The configuration will be described. In FIG. 14, reference numeral 11 denotes a telephone A used by the user A, 12 denotes a personal computer A used by the user A, 13 denotes a telephone B used by the user B, 14 denotes a personal computer B used by the user B, and 15 denotes the telephone A1.
1, a public telephone network connecting a telephone B13, and 16 is the Internet to which the personal computers A12 and B14 subscribe. The personal computer A uses “aaa.a” as the IP address.
a. aaa. aaa ", and the personal computer B uses" bbb. bb. bbb. bbb "and user A
And the user B can correctly recognize each other by the voice of the telephone.

Next, the personal computer A12 will be described with reference to FIG. Reference numeral 1201 denotes a user input unit including a keyboard and a mouse; 1202, a display unit as a display monitor; 1203, a hash generation unit that generates a hash from given data; 1204, a data encryption unit that encrypts data; A data decryption unit for decrypting the encrypted data; 1206, a program storage unit which is a fixed disk device storing an encryption communication program operating on the personal computer; 1207, a transmission / reception unit which is an interface circuit for performing external communication Reference numeral 1208 denotes a key pair generation unit that generates a pair of a public key and a secret key in a public key cryptosystem, 1209 denotes a secret key storage unit that stores the secret key generated by the key pair generation unit, and 1210 denotes an encrypted key. A common key decryption unit for decrypting the common key, and a common key storage unit 1211 for storing the decrypted common key. . The hash generation unit 1203, data encryption unit 1204, data decryption unit 12
05, the key pair generation unit 1208 and the common key decryption unit 1210
Is realized by a CPU (Central Processing Unit). The secret key storage unit 1209 and the common key storage unit 1211 are RAM
(Random access memory).

Next, FIG.
1401 to 1407 have the same functions as 1201 to 1207 of the personal computer A12, respectively.
Denotes a display unit, 1403 denotes a hash generation unit, 1404 denotes a data encryption unit, 1405 denotes a data decryption unit, 1406 denotes a program storage unit, and 1407 denotes a transmission / reception unit. Reference numeral 1408 denotes a common key generation unit that generates a common key of the common key cryptosystem, and includes a random number generation unit (not shown), and generates a common key from the random number generated by the random number generation unit. Reference numeral 1409 denotes a common key storage unit for storing the common key generated by the common key generation unit 1408, reference numeral 1410 denotes a public key storage unit for storing a public key when performing cryptographic communication using the public key method, and reference numeral 141 denotes a public key storage unit.
Reference numeral 1 denotes a common key encryption unit that encrypts the common key stored in the common key storage unit 1409 with the public key stored in the public key storage unit 1410. The hash generation unit 140
3, data encryption unit 1404, data decryption unit 1405,
The common key generation unit 1408 and the common key encryption unit 1411 are realized by a CPU (Central Processing Unit). The common key storage unit 1409 and the public key storage unit 1410 are RAM
(Random access memory).

In the following, the user A is the personal computer B of the user B.
The following describes a procedure for accessing the communication device and performing communication by mutually encrypting data using the common key method. In this embodiment, as in the first embodiment, in order to use the common key method, it is necessary to share the common key first. The common key generated by the personal computer B is encrypted with the public key of the personal computer A, and the personal computer A And then perform encrypted communication. In order to facilitate understanding, a schematic procedure will be described with reference to FIGS.

In FIG. 16A, first, the personal computer A accesses the personal computer B. The personal computer A has a public key A and a corresponding private key A, and sends the public key A to the personal computer B. In FIG. 16B, when the personal computer B is accessed from the personal computer A, it generates (1) a common key, and (2) generates a hash from data obtained by combining the common key and the public key A. The hexadecimal representation of the upper two bytes is displayed on the display unit. (3) Further, the common key is encrypted with the public key A and (4) transmitted to the personal computer A. The personal computer A that has received the encrypted common key decrypts the encrypted common key with its own secret key A, and (6) uses the data obtained by combining the decrypted common key with its own public key A. A hash is generated, and the hexadecimal representation of the upper two bytes is displayed on the display unit. In FIG. 17, (1) User A and User B confirm that the displays on their personal computers match each other by voice over a telephone, and (2) When the matching is confirmed, the above common key And encrypts predetermined data to perform encrypted communication.

Hereinafter, the detailed operation will be described in the following (1) to (4) with reference to the flowchart of FIG. (1) Operation of the personal computer A (S301 to S306) First, the user A starts the encryption communication program of the personal computer A12, and inputs the IP of the personal computer B14 from the user input unit 11.
When an address is specified by inputting an address (S301), a message as shown in FIG. Here, the user A confirms the IP address of the communication partner, and clicks the connection.
Is transmitted to the server (S302). When the personal computer B receives the connection request of the personal computer B, the encryption communication program of the personal computer B is started, and a window as shown in FIG. Here, if the user B clicks the permission, the connection between the personal computer A and the personal computer B is established. If the user B clicks the rejection, the connection is not established. The personal computer A confirms the response (S303). If the connection is permitted, the key pair generation unit 1208 generates a secret key and a corresponding public key (S304), and stores the secret key in the secret key storage unit 1209. (S305). It is assumed that each of the secret key and the public key is, for example, 16 bytes. PC A12
Transmits this public key to the personal computer B14 (S30).
6).

(2) Operation of the personal computer B (S307 to S3)
14) Upon receiving the public key of the personal computer A12 (S307), the encryption communication program of the personal computer B14 stores the public key in the public key storage unit 1410 (S308). Next, in accordance with the encrypted communication program, the personal computer B14 generates a common key by the common key generation unit 1408 (S309) and stores it in the common key storage unit 1409 (S310). This common key is assumed to be, for example, 16 bytes. Next, FIG.
As shown in (3), the generated common key and the public key of the personal computer A12 are combined to generate combined data, and a hash is generated from the combined data (S311). This hash is, for example, 20 bytes and is the second verification data in the present invention. Next, a predetermined number of bytes at the head of the hash value, for example, 2 bytes, is converted into a hexadecimal number and displayed on the display unit (S312). The display unit displays numbers or four alphabetical characters from A to F. Further, the common key is encrypted with the public key of the personal computer A12 (S313).
The data is transmitted to the personal computer A12 (S314). (3) Operation of the personal computer A (S315 to S319) When the personal computer A12 receives the encrypted common key from the personal computer B14 (S315), the encryption communication program of the personal computer A decrypts this with the secret key of the information terminal A1. (S316), the decrypted common key is stored in the common key storage unit 121.
1 (S317). FIG. 2 shows the decrypted common key.
As shown in 0 (b), the data is combined with the public key of the personal computer A12 to generate combined data, and a 20-byte hash is generated from the combined data (S318). This hash is the first verification data in the present invention. Then, the first two bytes of the hash value are converted into hexadecimal numbers and displayed on the display unit (S319).

(4) Operation of User A (S320 to S32)
6) By the above operations from S301 to S319, four characters indicating the first two bytes of the hash are displayed on the display units of both personal computers. PC A and PC B at this time
Is a window for not only displaying the hash (4E69) as shown in FIGS. 21A and 21B, but also inquiring whether or not to continue the encrypted communication thereafter. Then, to confirm the hash match, the user A
Makes a call to user B (S320).

When the call is connected, the user A queries the user B for the first two bytes of the hash displayed on the personal computer B and confirms by voice that the two bytes match (S).
321). At this time, before confirming the hash by voice, the user A and the user B confirm that both are correct by the voice of the other party. As in the first embodiment, by confirming that the first two bytes of the hash match, it is estimated that if the first two bytes match, then 20 bytes of the entire hash match.

When it is confirmed that the first two bytes of the hash match, the telephone is terminated (S322) and the user A
Clicks “Continue” in FIG. 21A (S32
3). If they do not match, click "Stop". Clicking "Continue" is a trigger for starting the subsequent encrypted communication, and the display sections of the personal computers A and B open windows as shown in FIGS. The screen for inputting a directory for receiving a file is displayed on the personal computer B. When a transmission file is selected on the personal computer A and "Send" is clicked (S324), the selected file is encrypted with the common key and transmitted to the personal computer B (S325). At this time, windows such as those shown in FIGS. 23A and 23B are opened on the display units of the personal computers A and B. When the encryption communication is completed (S326), the windows shown in FIGS. Opens, and the personal computer A inquires whether another file is to be encrypted and transmitted. If "Yes" is clicked, the window returns to the window shown in FIG. 22 (a) and the input of the transmission file is requested again, and if "No" is clicked, the encrypted communication ends (S32).
6). When the encryption communication is completed, the common keys stored in the common key storage units 1211 and 1409 of the personal computers A and B are deleted by the encryption communication program (S32).
7).

In the above example, as shown in FIG. 20A, the personal computer B generates combined data from the received public key of the personal computer A and the common key generated by itself, and generates a hash from the combined data. Also, as shown in FIG. 20B, the personal computer A decrypts the common key encrypted and transmitted from the personal computer B and then combines it with its own public key to generate combined data, and generates a hash from the combined data. are doing. Then, the user A and the user B mutually compare the hashes generated by the respective personal computers. The reason for this is that, in the description of the first embodiment, if the hash is generated only from the common key generated or the decrypted common key as shown in FIGS. This is for the same reason as explained that there is a danger of the common key being stolen and eavesdropping if you have it. That is, the personal computer B generates a hash from only the common key generated by itself, and the personal computer A also generates a hash from only the decrypted common key, and the user A and the user B only compare the hash generated by each personal computer with each other. This is because, for example, if a provider of the Internet has malicious intent, the common key is stolen by the provider and security of encrypted communication cannot be ensured. In this case, if the relay station 3 in FIG. 7 is replaced by a malicious provider, and this provider holds a unique public key and a corresponding private key, the provider can be shared by the same method as in the first embodiment. This is because it is possible to steal the key.

Embodiment 4 Embodiment 4 will be described with reference to FIG. 4 and FIGS. In the first to third embodiments, after generating a hash, the hash is converted to hexadecimal and displayed on the display unit. An example is shown in which the image is converted into a sound, a smell and the like and displayed.
These characters, figures, moving images, sounds, smells, and the like are the verification data in the present invention. The “characters” include meaningful words and sentences in addition to individual characters.

Referring to the drawings, FIG. 4 is a flowchart already described in the first embodiment, FIG. 25 is a block diagram of the present embodiment, and FIGS. 26 and 28 to 33 are diagrams of a verification data conversion table in the present embodiment. FIG. 27 is a diagram showing an example of a display state in the present embodiment.

Next, the structure will be described. In FIG. 25, the same components as those in FIG. In FIG. 25, reference numerals 601 and 602 denote verification data conversion tables held by the information terminals A1 and B2, respectively.

The operation of the present embodiment follows the same flowchart as that of the first embodiment shown in FIG. In the first embodiment, the information terminals A and B convert the hash into a hexadecimal number and display the hexadecimal display on the display units 103 and 203 in the hash value display in S111 and S118. Refers to the verification data conversion table, associates the hash with a specific character or a meaningful word, and displays the associated character or word on the display unit.

The verification data conversion tables 601 and 602 associate the upper two bytes of the hash generated by the hash generators 105 and 205 with the corresponding characters and words as shown in FIG. Approximately 65,000 types of characters are required to associate the upper two bytes with each individual character or word. In this case, for example, the term may be cited from a Japanese language dictionary in which terms exceeding this are described. In this case, a term that is not commonly used may be displayed. FIG. 27 is an example in which characters and words are displayed on the display unit of the information terminal. In S119, the user A and the user B confirm that the characters and words displayed on their own display units match the ones displayed on the display unit of the other party, respectively. Input and perform encrypted communication.

FIG. 28 is a verification data conversion table for associating the upper 1 byte of the hash with the corresponding word. In this case, since the words are associated with 256 types of words, only words that are commonly used may be selected and associated. In addition, not only words but also meaningful sentences as shown in FIG. 29 may be used.

As described above, according to this embodiment, the hash is associated with an easily understandable character, word, or sentence, so that it is easy to transmit to the other party, and it is easy to compare with each other. This has the effect.

The verification data conversion table may be associated with a hash and a specific figure as shown in FIG. In S119 of the flowchart of FIG. 4, each of the user A and the user B confirms by voice that the graphic displayed on their own display unit matches the graphic displayed on the display unit of the other party, and if they match, For example, a user confirmation input is performed in S120, and encrypted communication is performed. In this case, the hash is associated with a figure that is easy to understand, so that the hash can be easily transmitted to the other party.

Further, a graphic may be a moving image instead of a mere still image, and its movement may be associated with a hash value. FIG. 31A shows an example of the verification data conversion table. If the upper byte of the hash is 8A, it is associated with the “swim” operation, and a moving image as shown in FIG. 31B is displayed. Displayed in the section. In this case, the hash is associated with an easy-to-understand video, so it is easy to communicate to the other party,
There is an effect that it is easy to compare with each other and fun is generated when transmitting.

Further, the verification data conversion table may be made to associate a hash with a specific sound as shown in FIG. Here, the sound refers to any sound including music and human voice. In this case, S in the flowchart of FIG.
At 119, the music associated with the hash flows from the speaker of the voice input / output unit 2 of the information terminal. User A
And the user B tells the other party by voice what the music being played from his own information terminal is, and confirms that they match. If they match, a user confirmation input is performed in S120, and encrypted communication is performed. At this time, the title of the music may be displayed on the display unit. Also, this music is input from the microphones of the audio input / output means 102 and 202 of each information terminal, transmitted to the other via the audio transmission path, and the receiving side listens to it and plays the music from its own information terminal. You may confirm that it matches the music you are playing. Of course, at this time, it is necessary that the user A and the user B confirm the other party by voice. In this case, since the hash is associated with the music that is easy to understand, it is easy to transmit the hash to the other party, and it is easy to compare with each other.

The verification data conversion table may associate a hash with a specific odor as shown in FIG. 33, and each information terminal may include an odor generator (not shown). FIG. 33 shows an example in which only the upper 4 bits of the hash are associated with the odor in consideration of the resolution of the human olfactory odor, and 16 types of odors are associated. The number of bits of the hash to be compared is not limited to 4 bits. In this case, since the hash is associated with the odor which is easy to understand, there is an effect that it is easy to transmit to the other party, it is easy to compare each other, and it is also fun to transmit when transmitting.

The verification data conversion table in the above description does not need to be secret. When a user compares a character, a graphic, and the like associated with this table by voice, the eavesdropping is performed, and even if the original hash is restored by referring to the table in reverse, it is impossible to restore the common key from this hash. Because it is possible.

In the above description, an example in which the verification data conversion table is applied to the information terminal described in the first embodiment has been described. Is also good. The operation in that case is performed in accordance with the flowcharts of FIGS.
At 110, S312 and S319 in FIG. 18, the verification data conversion table is referred to.

Embodiment 5 The configuration and operation of Embodiment 5 of the present invention will be described. FIG. 34 is a diagram showing a configuration of information terminals 11b and 22b in the present embodiment. In the figure, 6 is a communication path, 102a is a voice input unit, 102
b is an audio output unit, 108a is a transmission unit, 108b is a reception unit, 113 is a secret information decryption unit, 114 and 214 are secret information storage units, 128 and 228 are communication mode storage units, 213
Is a secret information encryption unit, and 215 is a secret information generation unit. Other elements are the same as the elements of the configuration shown in FIG. FIG. 35 shows the information terminal 1
It is a flowchart which shows the flow of a process between the encryption communication processing apparatuses which are 1b and 22b. 36 to 41 illustrate the processing of the encryption communication device.

The operation of the cryptographic communication devices (information terminals 11b and 22b) will be described below with reference to the drawings. In the cryptographic communication device 1b that starts communication, ID information such as a telephone number for specifying the other party is input to specify the other party (step S201). Next, the key pair generation unit 109
Key pair of a public key / private key in a public key cryptosystem such as an encryption key or an elliptical cryptosystem, or a key pair of a public key and a secret key in a secret sharing system such as a DH system or a double key system (step S2).
02). The generated secret key is stored in the secret key storage unit 110 (step S203). The connection with the encryption communication device 2b is established via the communication path 6 (step S204). Step S20 is performed from the cryptographic communication device 1b to the cryptographic communication device 2b.
The public key generated in step 2 is transmitted from the transmitting unit 108a to the communication path 6 (step S205). FIG. 36 shows the state of the processing from step S202 to step S206.

The encryption communication device 2b receives the public key of the encryption communication device 1b from the communication path 6 via the receiving section 208b (step S206). The received public key is stored in the public key storage unit 211 (Step S207). In the cryptographic communication device 2b, the secret information generation unit 215 generates 16-byte secret information (step S208). The generated secret information is stored in the secret information storage unit 214 (Step S209). The SHA1 hash value of the stored secret information is generated by the hash generator 205 (Step S
210). For example, the first 4 bytes of the 20-byte hash value are converted into hexadecimal numbers and displayed on the display unit 124 (step S211). The cryptographic communication device 2b further encrypts the secret information stored in the secret information storage unit 214 by the secret information encryption unit 213 using the public key stored in the public key storage unit 211 using a public key encryption method. (Step S212). The secret information encrypted for the encryption communication device 1b is transmitted to the communication path 6 via the transmission unit 208a (step S213). The encryption communication device 1b is connected to the communication path 6
, The encrypted secret information is received by the receiving unit 108b (step S214). The received encrypted secret information is
It is decrypted by the public key cryptosystem using the secret key stored in the secret key storage unit 110 (step S216). The decrypted secret information is stored in the secret information storage unit 114.
The SHA1 hash value of the stored secret information is generated by the hash generation unit 105 (step S217). 20
The first 4 bytes of the byte hash value are converted into hexadecimal numbers and displayed on the display unit 103 (step S218). FIG. 37 shows the state from step S208 to step S218.

The users of the cryptographic communication devices 101 and 102 exchange the hash value information of the display unit by mutual voices,
By confirming that the hash values displayed on the respective cryptographic communication devices are the same, the cryptographic communication devices 1b, 2b
Confirm that the secret information has been correctly shared (step S219). FIG. 38 shows a state where the users of the cryptographic communication devices confirm that the same hash value is displayed on the display unit of each cryptographic communication device. After confirmation, the encryption communication device 2
The user (b) inputs to the user confirmation input unit 204 that the sharing of the secret information has been confirmed and that the encrypted communication is to be started. This is shown in FIG. In the figure, the user confirmation input section is an encrypted communication start button, and when the user presses it, the user can confirm that the secret information has been shared. Is shown. When the start of the encrypted communication is instructed by the user confirmation input unit 204, information indicating the encrypted communication mode is stored in the communication mode storage unit 228 (step S22).
1). In the cryptographic communication mode, the cryptographic communication device 2b converts the 16-byte secret information stored in the secret information storage unit 214 into the 16-byte secret information stored in the secret information storage unit 214 using the common key cryptosystem. It is used as a MISTY key, and is encrypted by the common encryption algorithm MISTY in the voice encryption unit 206. The encrypted audio information is transmitted to the communication path 6 by the transmission unit 208a.
The 16-byte secret information stored in the secret information storage unit 114 is used as the MISTY key, and the encrypted audio information received by the encryption communication device 1b is decoded by the audio decoding unit 107 in the MISTY. The decoded audio information is output from the audio output unit 102a (Step S222).

On the other hand, upon detecting that the encrypted voice information has been received, the encryption communication device 1b stores information indicating that the communication mode is the encryption communication mode in the communication mode storage unit 128. Like the encryption communication device 2b, in the encryption communication mode,
The voice information of the user of the cryptographic communication device 1b input from the voice input unit 102b converts the 16 bytes of secret information stored in the secret information storage unit 110 into the common key cryptosystem MISTY.
, And is encrypted by the common encryption algorithm MISTY in the voice encryption unit 106. The encrypted audio information is transmitted to the communication path 6 by the transmission unit 108a. The encrypted audio information received by the encryption communication device 2b is
The 16-byte secret information stored in the secret information storage unit 214 is used as the MISTY key, and the audio decryption unit 207 is used.
Is decoded by MISTY. The decoded audio information is output from the audio output unit 202a (Step S22)
2).

Both the encryption communication devices 1b and 2b are in the non-encryption communication mode from the start of the call until the encryption communication mode is set. In the non-encryption communication mode, normal voice communication to which encryption processing is not applied is performed. The left side of FIG. 41 shows a voice packet used for voice exchange in the non-encrypted communication mode, and the right side shows a voice packet used for voice communication in the encrypted communication mode. A voice packet in the encrypted communication mode is composed of encrypted identification information indicating that the packet is encrypted and encrypted voice information. By receiving a packet including the encrypted identification information from the other party in the non-encrypted communication mode, it is possible to detect that the other party has started encrypted communication. When the user of the cryptographic communication device 1b, 2b instructs to end the communication, the cryptographic communication ends (Step S
223). When the encrypted communication is completed, the secret key information storage 1
14 and 214, the secret key stored in the secret key storage unit 110, and the public key stored in the public key storage unit 211 are deleted (step S22).
4).

As described above, according to the fifth embodiment, since the secret information is encrypted by using the public key, the secret information can be shared between the encryption communication devices without anyone eavesdropping. . Also, by exchanging the hash value of the shared secret information by voice communication that allows mutual authentication of the other party and confirming that they match, both parties can confirm that the secret information has been shared with the correct other party. Since it is difficult to estimate the original information from the hash value exchanged by voice, even if the hash value information is eavesdropped, secret information that is to be shared does not leak. Therefore, secure secret sharing can be realized. By using the shared secret information as a key of the common key cryptosystem, high-speed and secure cryptographic communication can be performed.

According to the present invention, by utilizing voice communication in which authentication of a partner is performed very naturally for partner authentication, the effect of simplifying the secret sharing process required for encrypted communication is great. Since the public key certificate is not used, the process of issuing the public key certificate becomes unnecessary, and the operation of the user is simplified. In addition, since the process of verifying the public key certificate is not required, the implementation by software and hardware is simplified.

FIG. 42 is a flow chart showing the flow of another processing in this embodiment. This method omits the procedure in which the user specifies an instruction to start encrypted communication from the method described in the fifth embodiment. Steps S901 to S919 are the same as steps S201 to S218. In step S919, when using voice to confirm that the displayed hash values are the same, secret information that is assumed to share the voice is encrypted by a common key encryption method as a common key.

If the voice of the other party cannot be heard, the secret information cannot be shared, and the communication is stopped (steps S923 and S924). When the other party's voice is heard, the hash value is confirmed by voice.
If the hash values do not match, there is a possibility that the relay station of the voice communication is acting improperly, so the communication is stopped (steps S923 and S924). If the hash values match, it means that the secret has been correctly shared, and the communication is continued as it is (step S922). At the end of the communication, the information used for the encrypted communication is deleted (steps S923 and S924). FIG. 43 shows that when the encryption start button is deleted from the information terminal and the failure to share the secret information is confirmed, the communication is stopped by pressing the “OFF” button. As described above, FIG.
According to the method described above, the communication is stopped only when the secret information is not successfully shared. Therefore, when the sharing of the secret information is normally successful, the procedure for starting the encrypted communication is reduced.

Embodiment 6 FIG. The present embodiment is suitable for the purpose of preventing advanced fraud, the concept of which is shown in FIG. In such a high degree of fraud, the relay person can share the same secret information with the information terminals A and B. FIG. 44 is a diagram illustrating such advanced fraud. It is assumed that the information terminals A and B exchange the SHA1 hash value of the shared secret information by voice. It is assumed that RSA is used as an encryption method used for secret sharing. The transponder who performs the fraud has his / her public key / private key pair in advance. When the information terminal A acquires the public key of the information terminal A transmitted to the information terminal B, the information terminal B
Then, instead of the public key of the information terminal A, the public key of the relay station is transmitted. When the information terminal B obtains the public key of the relay, the information terminal B encrypts the generated secret information with the public key and transmits the encrypted secret information to the relay.

The relayer decrypts the encrypted secret information with its own secret key, stores it, encrypts it with the public key of information terminal A, and sends it to information terminal A. The relayer has shared the same secret information with the information terminals A and B. Then, when the encrypted communication using the confidential information is performed via the relay, the contents of the encrypted communication can also be known by the relay.

In this embodiment, when a hash value is calculated at information terminals A and B, the hash value is
It is determined from the combined information of the public key and the secret information. By doing so, it is confirmed that the information terminal B has certainly used the public key passed by the information terminal A.
Can be checked. FIG. 45 shows the flow of the processing. In the information terminal A, the public key of the information terminal A and the information terminal A
Then, the secret information transmitted from the information terminal B, which is obtained by decrypting with the secret key (S1201), is combined (step S1201). Next, a hash value is generated from the combined information (step S12).
02). The information terminal B combines the public key of the information terminal A with the generated secret information (step S1301). Then, a hash value is generated from the combined information (step S1302). As described above, in the present embodiment, if the public key of the information terminal A and the public key received by the information terminal B are different, the hash values displayed at the respective terminals do not match, so that the sharing by the malicious relayer is not possible. Leakage of secret information can be prevented.

Embodiment 7 FIG. The present embodiment aims at preventing sophisticated misconduct by the method shown in FIG. In the fraudulent act of the present embodiment, although the information terminal A and the information terminal B do not share the secret information, the displayed hash values are the same, and further, the relayer transmits the two secret information. In other words, they are shared with the information terminals A and B respectively. Therefore, even if encrypted communication is performed between the information terminals A and B, the contents are all leaked to the relay person. The advanced fraud shown in FIG. 47 will be described.

Information terminal A and information terminal B exchange the first n bytes of the SHA1 hash value of the shared secret information by voice. In addition, RS is used as an encryption method for secret sharing.
A is used. The transponder who performs the fraud has his / her public key / private key pair in advance. And the information terminal A
Obtains the public key of the information terminal A transmitted to the information terminal B, transmits the public key of the relay terminal to the information terminal B instead of the public key of the information terminal A. When the information terminal B acquires the public key of the relay, the information terminal B encrypts the generated secret information B with the public key and transmits the encrypted secret information B to the relay. The transponder decrypts the encrypted secret information B with his / her own secret key, stores the secret information B, combines the secret information B with the transponder's public key, and starts the hash value n
Find bytes. This value is defined as HASHn. Next, the secret information A satisfying the following conditions is calculated. In other words, the condition is that the hash value is obtained by combining the public key of the information terminal A and the secret information A, and the first n bytes are HASHn. When the value of n is small, such secret information A can be obtained in a finite time. Then, the secret information A is encrypted with the public key of the information terminal A and sent to the information terminal A. The secret information A and the secret information B are different secret information, and the public key of the information terminal A and the public key used for encrypting the secret information B by the information terminal B are also different. However, the hash values displayed on the information terminals A and B are the same, and the users of the information terminals A and B cannot detect that each shares the secret information with the relay. . Therefore, if the encryption communication is performed by the common key encryption using the secret information as a key thereafter, the communication contents are leaked to the relay.

FIG. 48 is a diagram showing the flow of processing in this embodiment corresponding to such a high degree of misconduct.
When the fraud shown in FIG. 47 is performed, a calculation process is performed by the relay person. If the time required for the secret sharing between the terminals takes a predetermined time or more, a means for interrupting the communication is realized. ing. In the information terminal A, the time T1 at which the information terminal A sent the public key to the other party is stored (step S1).
1501). The time T2 at which the encrypted secret information is received from the information terminal B is stored (step S150).
2). If T2−T1 is longer than the predetermined time, it is determined that an illegal operation has occurred, and the communication is interrupted (step S1503).
If T2-T1 is equal to or less than the predetermined time, the process is continued (step S1504). As described above, in the present embodiment, the time from the transmission of the public key to the reception of the encrypted confidential information can be ascertained at the information terminal A, so that the improper act of the relay person can be detected.

The fraud shown in FIG. 47 can be prevented by increasing the size of the hash value to be compared. FIG.
Contains all information of 20 bytes of the hash value of SHA1 as 1
An example represented in hexadecimal notation is shown. FIG. 50 shows an embodiment in which this information is displayed on the information terminal. In FIG. 50, in order to display the hash value represented by 40 characters five times in eight characters, the portable terminal displays a “next” button for switching the display of the hash value to the next character string, and displays one of the hash values. A “return” button is added to the information terminal.
When the users of the information terminal A and the information terminal B can mutually confirm the eight-character hash value displayed on the screen by voice, the user presses a “next” button to confirm the hash value of the next eight characters. move on. Then, it is confirmed that all of the forty characters appearing five times match. As described above, in the present embodiment, in order to more securely confirm secure secret sharing, it is understood that it is better to increase the information of the hash value confirmed by voice. By providing a “next” and “return” button for displaying the divided hash values one after another on the screen, the user can easily operate the hash value dividing unit, and the information of all hash values can be obtained. You can check that they match.

Further, in the embodiment, when the user of one terminal presses the “next” button, a command corresponding to the button is sent to the other terminal, and the next hash value is transmitted from the other terminal. It may be sent and displayed. That is, a means for displaying the same portion of the hash value on the partner's terminal even when the user does not operate the button is added. According to this means, the process of pressing the “next” and “return” buttons required for the hash value confirmation operation can be performed by one of the two communicating parties, so that the hash value can be confirmed more efficiently. This is shown in FIG.

Embodiment 8 FIG. FIGS. 52 to 66 show the state of processing in the eighth embodiment of the present invention. FIG. 67 is a flowchart showing the flow of processing in this embodiment. The operation will be described below with reference to the flowchart in FIG. In this embodiment, FIG.
It is assumed that Mr. A and Mr. B regularly communicate with each other via a telephone connected to a public telephone network and a PC connected to the Internet. In this description, A
'S phone number is 03-5678-1234 and A
The IP address of his PC is 141.23.45.67
And Mr. B's telephone number is 03-1234.
5678, and the IP address of Mr. B's PC is 12
1.32.123.201. A and B frequently contact each other over the phone, and if they hear each other, they can authenticate the other party immediately.

In Mr. A's PC, an encrypted file communication program has been started as shown in FIG. Then, the communication partner B's IP address is specified (step S34).
01), a connection button is clicked and a connection request is transmitted to Mr. B (step S3402). When the connection request is received by B's PC (step S3403), B's PC
The encryption file communication program activated in step (1) notifies the PC screen that the communication request has arrived (FIG. 54).
Mr. B permits the connection by clicking the permission button (step S3404). Mr. B's encrypted file communication program sends a communication permission notification to Mr. B's encrypted file communication program. A who received the notice
Mr. B's encrypted file communication program confirms that Mr. B has permitted the connection (step S3405), and generates a key pair (step S3406). Step S3407
Step S3421 is the same as Step S205 to Step S218. This is shown in FIGS. On the confirmation screen of the hash value, on the PC of Mr. A,
The PC of Mr. B in FIG. 57 is as shown in FIG.

With the screens shown in FIGS. 57 and 58 being displayed, Mr. A calls Mr. B at 03-1234-5678. A and B confirm that the hash values displayed on the PC screen match with each other's voices authenticating each other (step S).
3423). FIG. 59 shows how a hash value is confirmed by voice using a telephone. After confirming that the hash values match each other, Mr. A clicks the continue button in FIG. Then, a screen for selecting a file to be encrypted and transmitted using the common key encryption method using the shared secret information as a common key is displayed (FIG. 60), and a file name to be encrypted is selected (step S3426). . FIG.
When the transmission button 7 is clicked, a notification of the start of encrypted file communication is sent from Mr. B's encrypted file communication program to Mr. B's encrypted file communication program.

Upon receiving the message, the encryption communication program of Mr. B displays an input screen for the storage directory of the received file (FIG. 61). B inputs the name of the storage directory and presses the OK button. Then, the encrypted file communication preparation completion notification is sent from Mr. B's cipher file communication program to Mr. A's cipher communication program. The encrypted file communication program on the side of Mr. A who has received it is the selected file patent. MIS using secret information sharing the doc as a key of the common key cryptosystem MISTY
The data is encrypted by TY and transmitted. Upon receiving the encrypted file, Mr. B's encrypted file communication program transmits the secret information sharing the encrypted file to the common key cryptosystem M.
The key is decrypted by MISTY as the key of ISTY (step S3428). During the transmission of the encrypted file, Mr. A's encrypted file communication program displays the screen of FIG. 62, and Mr. B's encrypted file communication program displays the screen of FIG.

When the file encryption transmission is completed, Mr. A's encryption communication program displays the screen shown in FIG. If Mr. A clicks the Yes button, a file transfer completion notification is sent from Mr. A's encrypted file communication program to Mr. B's encrypted file communication program (step S3528. Mr. A's encrypted file communication program is shared). The secret information and the key information used for encryption are erased and the process is terminated, and the encrypted file communication program of Mr. B who received the file transfer completion notice also displays the screen of FIG. (Step S3429) As described above, according to this embodiment, the other party is authenticated using the existing telephone line, and the operation is performed on the PC. It can be confirmed that the cryptographic file program can safely share the secret with the correct party, so that the encryption on the PC From the Airu communication program, it is possible to remove the partner authentication function, the scale of the program is reduced.

Embodiment 9 FIG. FIG. 68 is a diagram illustrating a case where moving image communication in which the face of the other party is visible is used for the displayed hash value confirmation unit as the present embodiment. As described in Embodiment 8, a hash value of shared secret information displayed on a display by a program running on a PC, or a hash value of shared secret information displayed on a display unit of a mobile phone, or Shared between video calls,
The hash value displayed on a part of the video display unit of the videophone is copied on paper. Then, the user exchanges his / her face and the hash value written on the paper with the video.

As described above, according to the present embodiment, the other party can be authenticated without using voice by looking at the other person's face in the video, and the hash value information of the secret information shared with the video is exchanged. By doing so, it can be confirmed that the secret has been shared with the correct partner.

Embodiment 10 FIG. In the embodiment,
DH (Diffie-Hellman method) for secret sharing
Is used. FIGS. 69, 70, and 71 show how two information terminals share secrets using DH.

In the information terminal 1, a G that satisfies the prime numbers P and 1 <G <P is selected. Next, a random number R1 is generated, and G ^R1 mod
Calculate P. Then, P, G, and G ^R1 mod P are transmitted to the information terminal 2 (FIG. 69). P, G, G ^R1 mod
The information terminal 2 that has received P generates a random number R2, and G ^R2 mo
dP is calculated, and G ^R2 mod P is transmitted to the information terminal 1 (FIG. 70). The information terminal 1 receives the received G ^R2 mod
Raise P to the power of R1. The information terminal 2 sets G ^R1 mod P to R 2
Take it. G ^R2 to R1 square and G ^R1 modP of mod P R2
The power has the same value G ^R1 · ^R2 mod P, and the value G ^R1 · ^R2 m
The odd P is the secret information shared by both terminals. DH
Since the method does not have a partner authentication function, the hash value of the shared secret information G ^R1 · ^R2 mod P is displayed on the display unit as shown in FIG. By confirming each other, it is confirmed that the confidential information G ^R1 · ^R2 mod P is shared with the correct partner. Note that the same G and P may be stored in advance in all terminals so that the exchange of G and P may not be necessary. As described above, according to the present embodiment, DH shares secret information, exchanges hash values of the shared secret information by voice communication, and confirms that they match, thereby sharing the secret with the correct partner. You can see what you can do.

Embodiment 11 FIG. The secret communication according to the present embodiment will be described with reference to the explanatory diagrams of FIGS. 72, 73, and 74. That is, in the present embodiment, a key is stored in an IC card or the like in advance and used. First, as shown in FIG. 72, a person using an information terminal stores key information necessary for secret sharing in a portable card such as an IC card or a PC card in advance. When performing the encrypted communication, the portable card is inserted into the information terminal, the public key stored in the portable card is read, and sent to the communication partner (FIG. 73).
When the communication partner returns the encrypted secret information with the public key, the encrypted secret information is decrypted using the secret key stored in the mobile card. The hash value of the shared secret information is displayed on each display unit (FIG. 7).
4). As described above, in the present embodiment, key information used for secret sharing is generated and stored in the portable card in advance, so that key generation processing time is not required.

The IC card and the like in the present embodiment can be extendedly used. FIGS. 75 to 79 are diagrams for explaining other processes in the present embodiment. That is, in these figures, the secret information shared by the information terminals is written on a portable card, and the written portable card is inserted into a necessary terminal and used. An example in which encrypted communication can be performed using an arbitrary information terminal capable of reading secret information by inserting the portable card is shown.

First, the two users insert their portable cards into their respective information terminals (FIG. 75). Next, the secret information is shared between the information terminals A and B by the same processing as the processing described in the fifth embodiment (FIGS. 76 and 77).
Next, the shared secret information is copied to each portable card (FIG. 78). Next, the two users insert the mobile cards into a PC having means for reading the contents of the respective mobile cards. The encryption communication program running on the PC is
The secret information stored in the portable card is read out, and encrypted communication is performed by the common key encryption method using the secret information as a key of the common key encryption method (FIG. 79). As described above, according to this method,
Since the sharing of the security secret that has been authenticated by the other party, which complicates the processing, is performed by a dedicated information terminal, the encryption communication program executed on the PC only needs to implement the processing of the common key cryptosystem. Can be smaller.

Embodiment 12 FIG. FIG. 80 and FIG. 81 are diagrams showing the flow of processing in the present embodiment. In a mobile phone, the location is divided into a plurality of areas, and each mobile phone always belongs to one area. Each base station knows which mobile phone belongs to its own area by communicating with each mobile phone. In this embodiment, when the area of the mobile phone is changed due to movement, the mobile phone registers its own public key with the base station in the base station in the changed area. In FIG. 80, information terminal A belonging to the Tokyo area
However, the public key of the information terminal A is registered in the information terminal base station in Tokyo, and the mobile terminal B belonging to the Osaka area registers the public key of the information terminal B in the information terminal base station in Osaka.

When the information terminal A wants to share a secret with the information terminal B, as shown in FIG. 81, the Tokyo base station to which the information terminal A belongs obtains the public key of the information terminal B from the Osaka base station, It is passed to the information terminal A. The information terminal A that has obtained the public key of the information terminal B generates the secret information, encrypts the secret information with the public key of the information terminal B, and transmits it to the information terminal B. The procedure for displaying the hash value of the combined information of the public key and secret information thereafter and confirming that the shared information is shared by voice communication is as follows:
This is the same as the seventh embodiment. As described above, in this embodiment, the public key of the other party is obtained not from the information terminal of the other party but from the base station, so that the communication procedure between the terminals can be simplified.

Embodiment 13 FIG. A case is shown in which a magnetic medium for permanently storing key information required for secret sharing is added to the information terminal (FIG. 82). According to the present embodiment, the generated key information remains on the magnetic medium even when the cryptographic communication with the other party is terminated or the information terminal is turned off (FIG. 8).
3) Therefore, it is not necessary to generate a key pair when trying to share secrets again.

The key information stored in the magnetic medium described in the thirteenth embodiment may be deleted in consideration of security (FIG. 8).
4, FIG. 85). FIG. 84 shows an example in which a public key and a secret key stored in a magnetic medium are deleted when a fixed number of calls are made. FIG. 85 shows an example in which the key pair is erased from the magnetic medium after a certain period of time has elapsed after the generation of the key pair. By doing so, if the number of calls with the other party or the key generation time exceeds a certain value, the public key and secret key will be recreated, reducing the probability of decrypting the shared secret information and improving security I do.

Furthermore, in the information terminal, the shared secret information may be stored in a magnetic medium in association with each sharing partner. FIG. 86 is a diagram showing secret information B shared with information terminal B, secret information C shared with information terminal C, and secret information D shared with information terminal D in a magnetic medium in information terminal A.
Indicates that the secret information B, C, and D are permanently stored in the magnetic medium of the information terminal A even when the communication ends or when the power is turned off. According to the present embodiment, if the communication partner is specified and the secret information shared with the communication partner is stored, a new process of sharing the secret becomes unnecessary.

Further, in this embodiment, the secret information stored in the magnetic medium may be erased in consideration of security. That is, FIG. 87 shows that the secret information shared with C is used as a key of the common key
An example is shown in which the shared secret information with C is erased when the number becomes MByte or more. FIG. 88 shows an example in which the shared secret information with C is deleted when 10 days or more have passed after the information was shared with C. FIG. 89 shows an example of erasing the shared secret information with C when the time of the encrypted communication using the secret information shared with C exceeds 10 hours.
In this way, when the time of the encrypted communication using the shared secret information, the amount of the encrypted communication, and the elapsed time after sharing the secret exceed a certain value, the shared secret information is deleted,
Since a new one is recreated at the next communication, the probability that the shared secret information is decrypted is reduced, and the security is improved.

Embodiment 14 FIG. In the present embodiment, when the information terminal supports a plurality of common key encryption algorithms, a means for adjusting a common key encryption algorithm using shared secret information as a key will be described (FIGS. 90 and 9).
1). First, the information terminal A sends information terminal A to the information terminal B.
MISTY, T
Ripple-DES is obtained from the support encryption algorithm table and sent to the information terminal B. The information terminal B has the encryption algorithms MISTY and D
ES is obtained from the support algorithm table and MI
It recognizes that STY is an encryption algorithm that can be used in common, and informs information terminal A that MISTY will be used. As described above, it is understood by the information terminals A and B that the secret information is used as the key of the shared MISTY (FIG. 9).
0).

In FIG. 91, a common key encryption algorithm MISTY, DES, Tri supported by the information terminal A is shown.
Although the ple-DES is sent to the information terminal B, since the information terminal B supports only RC2, each of the information terminals A and B knows that there is no commonly usable encryption algorithm. As described above, according to the present embodiment, the information terminal has a plurality of supported cryptographic algorithm tables, and selects the matching one from among them. Can be adjusted to which encryption algorithm is the key.

Embodiment 15 FIG. In the fifth embodiment, random numbers are used for generating a key pair and generating secret information to be shared.
In generating random numbers, it is very important to give good random numbers. A good random number seed can be obtained by using a series of numerical values that are difficult to reproduce. In the present embodiment, the information terminal includes a random number seed generation device. FIG.
Means that after the information terminal is turned on, sound information representing one sample in 256 steps is collected from the microphone at a rate of 8000 samples per second, and a hash value of the collected sound information for two seconds is obtained. An example is shown in which a value is stored as a random number seed and used when generating a random number. Since it is difficult to reproduce the collected sound information again at another place and another time, a high-quality random number seed can be obtained. FIG.
The information terminal has a pedometer and a timer, measures one step, the interval of one step in milliseconds, expresses the result as a 2-byte integer,
SHA of 20 bytes of information, which is a time interval of 10 steps
One hash value of 20 bytes is stored as a random number seed,
The example used at the time of random number generation is shown. Since it is difficult to reproduce the collected time interval of each step at another place and another time, a high-quality random number seed can be obtained.

FIGS. 94 and 95 show that the time interval at which the push button of the mobile phone is pressed is measured in milliseconds, the hash value of the combined information of the time interval information is stored as a random number seed, and is used when generating the random number. An example is shown. It is difficult to reproduce the collected time intervals at which the push buttons are pressed at another place and another time as long as a human is pushing with a finger, so that a high-quality random number seed can be obtained.

Embodiment 16 FIG. In the present embodiment, an example is shown in which the hash value to be transmitted to the other party is converted into a word that is easy to understand, instead of a simple string of alphanumeric characters. In FIG. 96,
Hash values from 0 to 9999 are mapped to different words. For example, when the hash value is 1, FIG.
As in 7, the word "apple" is displayed. If the hash value is in the range of 8 digits from 0 to 99999999, a different word may be assigned to 0 to 9999999, or divided into the first 4 digits and the last 4 digits, and mapped to 0 to 9999, respectively. Convert to words, 2
Can be two words. That is, in the example of the mapping in FIG. 96, when the hash value is 99980001,
9998 0001 for 2 minutes and display "Kuma Mandarin". Since the hash value is converted into an easily understandable word, it is easy to tell the other party.

In FIG. 98, hash values from 0 to 9999 are mapped to different sentences. Since the hash value is converted into an easily understandable sentence, it is easy to convey to the other party. Fun occurs when communicating. In FIG. 99, 0
To 9999 are mapped to different animal characters. Since the hash value is converted to an easy-to-understand character, it is easy to tell the other party,
Also, fun occurs when communicating. Also, at the time of confirming the hash value by moving image communication, it is possible to intuitively instantly confirm that the character of the other party is the same as the character of the user.

In FIG. 100, hash values from 0 to 9999 are mapped to different melodies. Since the hash value is converted to an easy-to-understand melody, it is easy to tell the other party. Fun occurs when communicating.
In FIG. 101, hash values from 0 to 9999 are mapped to different odors. An odor generator is connected to the information terminal, and the odor generator is configured to generate different odors according to a value from 0 to 9999. The hash value is converted to a perceived odor, making it easier to communicate to the other party. Fun occurs when communicating.

In FIG. 102, hash values from 0 to 9999 are mapped to different operations. Fig. 103
FIG. 104 shows an example in which the action is presented to the user as the action of the character displayed on the information terminal.
The example shown to a user as operation of an electronic stuffed animal (robot) connected to the information terminal is shown. Since the hash value has been converted to a visually understandable behavior,
Easy to tell the other party. Fun occurs when communicating. Also, at the time of confirming the hash value by the moving image communication, it is possible to intuitively instantly confirm that the action of the other character or the electronic stuffed animal is the same as that of the user.

Embodiment 17 FIG. In the present embodiment, the present invention is applied to encryption on a telephone line when a mobile PC is used to access an intranet in a company from outside the company. Generally, when a mobile PC is used to connect to an intranet in a company from outside the company, FIG.
As shown in, the telephone number 090-1111-2222
Is connected to a mobile PC, and a telephone line program (for example, running on the mobile PC)
Windows-based dial-up network), which is an intranet access point.
Make a call to the assigned remote access server at 2222-2333. When the telephone line is connected, the mobile PC and the remote access server implement the computer communication protocol on the telephone line, receive the user name and password from the mobile PC, authenticate the user, and connect the mobile PC to the intranet. Allow The encryption of the data exchanged between the mobile PC and the computer in the intranet after the permission has to be performed between the mobile PC and the computer in the intranet. However, the encryption is often not performed due to the complicated implementation.

FIGS. 106 to 112 show the processing in this embodiment. In the present embodiment, secure secret sharing using the present invention is performed between a mobile phone connected to a mobile PC and a remote access server serving as an access point of an intranet, and communication over a telephone line is shared. Encrypt with confidential information. Therefore, the encrypted communication between the mobile PC and the computer in the intranet becomes unnecessary. When dialing from a mobile phone to 03-2222-3333 and sending a connection request to a remote access server, DH public information G, P and secret information R1 generated in the mobile phone are generated in the same manner as in the ninth embodiment. G, P, G
Send ^R1 mod P to the remote access server (Fig. 10
6). The remote access server holds a list of connectable telephone numbers, and uses the number notification function of the public telephone service to acquire the number of the connected mobile phone,
Check that the phone number is listed in the list of connectable phone numbers. If it is not listed, reject the connection. If it is listed, generate ^R2 , G ^R2 mod
P is calculated and transmitted to the connected mobile phone (FIG. 10
7). At this time, there is no guarantee that the remote access server and the mobile phone share the common secret information G ^R1 · ^R2 mod P.

For both the mobile phone and the remote access server,
Calculate G ^R1 · ^{R 2} mod P and further calculate its hash value. The mobile phone displays the hash value on the display unit, and the remote access server stores the hash value internally. The user of the mobile phone presses a push button and inputs a hash value. The input is G ^R1・^{R 2}
Using mod P as a key of the common key cryptosystem, the data is encrypted and transmitted to the remote access server. On the remote access server side, G ^R1 · ^R2 mod P is decrypted as a key of the common key encryption method, the push button sound selected as a result is recognized by the push button sound recognition unit, and the hash value inputted by the user of the mobile phone is used. Get the value. Then, ^GR1 / ^R2mod stored in the remote access server
Compare with the hash value of P. If they do not match, the communication is interrupted, and if they match, permission for communication is sent to the mobile phone (FIG. 111).

Thereafter, the communication between the mobile PC and the intranet is encrypted by the common key encryption method using the secret information G ^R1 · ^R2 mod P shared at the level of the telephone line between the mobile phone and the remote access server as a key of the common key encryption method. (FIG. 112). As described above, according to the present embodiment, the remote access server can be confident that the secret can be shared with the mobile phone. Since encryption at the telephone line level has been realized, wiretapping of communication between the mobile PC and the intranet can be prevented. Mobile PC
It is not necessary to incorporate a cryptographic function for realizing secure communication into the communication program. Furthermore, the use of public key certificates and the use of passwords that need to be remembered become unnecessary, thereby reducing the work of users and administrators. It cannot be ascertained by the above embodiment alone that the user of the mobile phone surely shared the secret with the remote access server. But,
By viewing the information accessible by the mobile PC after connecting to the intranet, it can be confirmed that there is no spoofing of the remote access server. This is because the intranet is constructed so that it is impossible for a spoofed malicious remote access server to access the intranet, and the user of the mobile PC can access the information on the intranet. Information or
This is because it can be determined by looking at the information.

The means for transmitting the hash value to the remote access server is performed by the voice of the portable telephone user, and the remote access server may have means for recognizing the user's voice. After sharing the secret information between the mobile phone and the remote access server and calculating the hash value, the remote access server sends the secret information to the mobile phone.
A message instructing the notification of the hash value displayed on the screen of the mobile phone by voice is notified to the mobile phone by voice or text. According to the instruction, the user of the mobile phone reads out the hash value of the secret information displayed on the display unit of the mobile phone, and transmits it as a voice to the remote access server (FIG. 113).

The remote access server which has received the read hash value information converts the voice information into hash value information by the voice recognition unit and compares it (FIG. 114).
If they do not match, the communication is interrupted. If they match, the communication permission is notified to the mobile phone. On the mobile phone side, it is necessary to switch between voice input and mobile PC input, and this is realized by pressing the sharp button. As described above, according to this method, the user of the mobile phone can input the hash value by voice, so that the operability is improved.

[0138] Furthermore, the mobile PC and the remote access server may perform secret sharing and encryption communication by a computer data communication protocol (for example, PPP protocol) using a telephone line. The communication program running on the mobile PC shares the secret information as in FIG. 105 and calculates the hash value. Then mobile P
The communication program operating on C displays a hash value on the screen of the mobile PC and displays a dialog for the user to input the hash value again. Then, when the user of the mobile PC inputs the hash value 39136 into the text field from the keyboard and clicks the OK button, the input hash value is sent to the communication program on the remote access server via the mobile phone (FIG. 116). Upon confirming that the hash values match, the communication program on the remote access server side instructs the communication program of the mobile PC to permit connection (FIG. 118). After that, the communication program running on the mobile PC and the communication program running on the remote access server perform common key cryptographic communication using the shared secret information as a key of the common key cryptosystem. As described above, according to the present method, secure encrypted communication can be performed between the communication program on the mobile PC and the communication program on the remote access server.

[0139]

As described above, according to the first aspect of the present invention, when sharing a common key between information terminals, the first information terminal transmits its public key to the second information terminal, The second information terminal encrypts the common key with the public key and transmits it to the first information terminal, and the first information terminal generates first verification data from the encrypted common key and the public key. Then, the second information terminal generates second verification data from the common key and the public key of the first information terminal, and after the users of the first and second information terminals confirm the other party by voice communication means, Since the first verification data and the second verification data are compared with each other by voice, even if the public key of the first information terminal has not been certified by a third party, it can be safely and securely shared with the correct partner. There is an effect that the key can be shared. In addition, regarding the sharing of a common key between information terminals, the public key of the first information terminal does not need to be certified by a third party or require other prior procedures.
This has the effect of reducing the burden on the user and reducing the scale of hardware and software.

According to the second aspect of the present invention, the Diff
ie, the first and second information terminals sharing a common key by the Hellman method respectively generate first verification data and second verification data from the common key, and the user of the first and second information terminals Since the first verification data and the second verification data are compared with each other by voice after confirming the partner by the communication means, the partner sharing the common key by the Diffie-Hellman method is the correct partner, and There is an effect that the key can be confirmed to be correct.

According to the third aspect of the present invention, since the first verification data and the second verification data are hashes generated by a predetermined procedure, the common key can be restored even if eavesdropped by voice. Therefore, there is an effect that security of the encrypted communication can be maintained.

According to the invention of claim 4, the information terminal has a display unit for displaying at least a part of the hash, and the information terminals compare the displayed hash, so that the hash can be easily confirmed. This makes it possible to easily confirm that the common key has been correctly shared with the correct partner by making comparisons easily with each other.

According to the fifth aspect of the present invention, the information terminal has a verification data conversion table for associating a given numerical value with a specific character, graphic, or moving image. Since the data is a character, a graphic, or a moving image in which the hash value generated in a predetermined procedure is associated with the verification data conversion table, it is easy to compare each other, and it is easy to correctly share the common key with a correct partner. There is an effect that can be confirmed.

Further, according to the invention of claim 6, the information terminal has a verification data conversion table for associating a given numerical value with a specific sound, and the first verification data and the second verification data have a predetermined value. Since the hash value generated in the procedure is a sound in which the hash value is associated with the verification data conversion table, it is easy to compare each other and it is possible to easily confirm that the common key has been correctly shared with the correct partner.

[Brief description of the drawings]

FIG. 1 is a system configuration diagram of a first embodiment.

FIG. 2 is a diagram illustrating an outline of an operation according to the first embodiment;

FIG. 3 is a diagram illustrating an outline of an operation in Embodiment 1;

FIG. 4 is a flowchart showing the operation of the first and third embodiments.

FIG. 5 is an explanatory diagram of a hash generation method according to the first embodiment.

FIG. 6 is an explanatory diagram of a hash generation method in which security of secret is not ensured in the first embodiment.

FIG. 7 is an explanatory diagram of data transmission when security of secrets is not ensured in the first embodiment.

FIG. 8 is a diagram illustrating hash generation in the case where a malicious relay station exists in the first embodiment.

9 is a diagram of an information terminal provided with a screen scroll button in Embodiment 1. FIG.

FIG. 10 is a system configuration diagram of a second embodiment.

FIG. 11 is a diagram illustrating generation of a common key according to the second embodiment.

FIG. 12 is a flowchart illustrating operation of the second embodiment.

FIG. 13 is a diagram of hash generation in the second embodiment.

FIG. 14 is a system configuration diagram of a third embodiment.

FIG. 15 illustrates functional blocks of a personal computer in Embodiment 3.

FIG. 16 illustrates an outline of an operation in Embodiment 3;

FIG. 17 illustrates an outline of an operation in Embodiment 3;

FIG. 18 is a flowchart illustrating an operation of the third embodiment.

FIG. 19 is a diagram showing an example of a display state of a display unit in operation in Embodiment 3.

FIG. 20 is a diagram showing hash generation by a personal computer in the third embodiment.

FIG. 21 is a diagram illustrating an example of a display state of a display unit in operation in Embodiment 3.

FIG. 22 is a diagram illustrating an example of a display state of a display unit in operation in Embodiment 3.

FIG. 23 is a diagram illustrating an example of a display state of a display unit in operation in Embodiment 3.

FIG. 24 is a diagram illustrating an example of a display state of a display unit in operation in Embodiment 3.

FIG. 25 is a system configuration diagram of a fourth embodiment.

FIG. 26 is a diagram of a verification data conversion table according to the fourth embodiment.

FIG. 27 illustrates an example of a display state in Embodiment 4.

FIG. 28 is a diagram of a verification data conversion table according to the fourth embodiment.

FIG. 29 is a diagram of a verification data conversion table according to the fourth embodiment.

FIG. 30 is a diagram of a verification data conversion table according to the fourth embodiment.

FIG. 31 is a diagram of a verification data conversion table according to the fourth embodiment.

FIG. 32 is a diagram of a verification data conversion table according to the fourth embodiment.

FIG. 33 is a diagram of a verification data conversion table according to the fourth embodiment.

FIG. 34 is a system configuration diagram of the fifth embodiment.

FIG. 35 is an operation flowchart in the fifth embodiment.

FIG. 36 is a diagram illustrating the operation of the fifth embodiment.

FIG. 37 is a diagram illustrating the operation of the fifth embodiment.

FIG. 38 is a diagram illustrating the operation of the fifth embodiment.

FIG. 39 is a diagram illustrating the operation of the fifth embodiment.

FIG. 40 is a diagram illustrating the operation of the fifth embodiment.

FIG. 41 is a diagram illustrating the operation of the fifth embodiment.

FIG. 42 is an operation flowchart of another system according to the fifth embodiment.

FIG. 43 is a diagram illustrating an operation of another system in the fifth embodiment.

FIG. 44 is a diagram illustrating an operation in the sixth embodiment.

FIG. 45 is an operation flowchart in the sixth embodiment.

FIG. 46 is an operation flowchart in the sixth embodiment.

FIG. 47 is a diagram illustrating the operation in the seventh embodiment.

FIG. 48 is an operation flowchart in the seventh embodiment.

FIG. 49 is a diagram illustrating a display example in which another hash value is increased in the seventh embodiment.

FIG. 50 is a diagram illustrating a display example of another hash value according to the seventh embodiment.

FIG. 51 is a diagram illustrating a display example of another hash value according to the seventh embodiment.

FIG. 52 is a diagram showing a connection relationship in the eighth embodiment.

FIG. 53 shows a display screen in Embodiment 8.

FIG. 54 is a diagram showing a display screen in Embodiment 8.

FIG. 55 is a diagram illustrating the operation in the eighth embodiment.

FIG. 56 is a diagram illustrating the operation in the eighth embodiment.

FIG. 57 is a diagram showing a display screen in the eighth embodiment.

FIG. 58 is a diagram showing a display screen in the eighth embodiment.

FIG. 59 is a diagram illustrating an operation in Embodiment 8;

FIG. 60 is a diagram showing a display screen in the eighth embodiment.

FIG. 61 is a diagram showing a display screen in the eighth embodiment.

FIG. 62 is a diagram showing a display screen in the eighth embodiment.

FIG. 63 is a diagram showing a display screen in the eighth embodiment.

FIG. 64 is a diagram illustrating an operation in Embodiment 8;

FIG. 65 is a diagram showing a display screen in the eighth embodiment.

FIG. 66 shows a display screen in Embodiment 8.

FIG. 67 is an operation flowchart in the eighth embodiment.

FIG. 68 is a diagram illustrating the operation in the ninth embodiment.

FIG. 69 is a diagram illustrating the operation in the tenth embodiment.

FIG. 70 is a diagram illustrating the operation in the tenth embodiment.

FIG. 71 is a diagram illustrating the operation in the tenth embodiment.

FIG. 72 is a diagram illustrating operation in Embodiment 11;

FIG. 73 is a diagram illustrating operation in Embodiment 11;

FIG. 74 is a diagram illustrating the operation in the eleventh embodiment.

FIG. 75 is a diagram illustrating operation of another system in the eleventh embodiment.

FIG. 76 is a diagram illustrating operation of another system in the eleventh embodiment.

FIG. 77 is a diagram illustrating operation of another system in the eleventh embodiment.

FIG. 78 is a diagram illustrating operation of another system in the eleventh embodiment.

FIG. 79 is a diagram illustrating operation of still another system in the eleventh embodiment.

FIG. 80 is a diagram illustrating operation in Embodiment 12;

FIG. 81 is a diagram illustrating operation in Embodiment 12;

FIG. 82 is a diagram illustrating operation in Embodiment 13;

FIG. 83 is a diagram illustrating operation in Embodiment 13;

FIG. 84 is a diagram illustrating operation of another system in the thirteenth embodiment.

FIG. 85 is a diagram illustrating operation of another system in the thirteenth embodiment.

FIG. 86 is a diagram illustrating operation of still another system in the thirteenth embodiment.

FIG. 87 is a diagram illustrating operation of still another system according to the thirteenth embodiment.

FIG. 88 is a diagram illustrating operation of still another system according to the thirteenth embodiment.

FIG. 89 is a diagram illustrating operation of still another system according to the thirteenth embodiment.

FIG. 90 is a diagram illustrating the operation in the fourteenth embodiment.

FIG. 91 is a diagram illustrating operation in Embodiment 14;

FIG. 92 is an operation flowchart in Embodiment 15;

FIG. 93 is an operation flowchart in the fifteenth embodiment.

FIG. 94 is an operation flowchart in the fifteenth embodiment.

FIG. 95 is a diagram illustrating operation in Embodiment 15;

FIG. 96 is a diagram illustrating operation in Embodiment 16;

FIG. 97 is a diagram illustrating operation in Embodiment 16;

FIG. 98 is a diagram illustrating operation in Embodiment 16;

FIG. 99 is a diagram illustrating operations in Embodiment 16;

FIG. 100 is a diagram illustrating operation in Embodiment 16;

FIG. 101 is a diagram illustrating operation in Embodiment 16;

FIG. 102 is a diagram illustrating operation in Embodiment 16;

FIG. 103 is a diagram illustrating operation in Embodiment 16;

FIG. 104 is a diagram illustrating operation in Embodiment 16;

FIG. 105 is a diagram illustrating operation in Embodiment 17;

FIG. 106 is a diagram illustrating operation in Embodiment 17;

FIG. 107 is a diagram illustrating operation in Embodiment 17;

FIG. 108 is a diagram illustrating operation in Embodiment 17;

FIG. 109 is a diagram illustrating operation in Embodiment 17;

FIG. 110 is a diagram illustrating operation in Embodiment 17;

FIG. 111 is a diagram illustrating operation in Embodiment 17;

FIG. 112 is a diagram illustrating operation in Embodiment 17;

FIG. 113 is a diagram illustrating operation of another system in Embodiment 17;

FIG. 114 is a diagram illustrating operation of another system in Embodiment 17;

FIG. 115 is a diagram illustrating operation of another system in Embodiment 17;

FIG. 116 is a diagram illustrating operation of still another system in the seventeenth embodiment.

FIG. 117 is a diagram for explaining operation of still another system in the seventeenth embodiment.

FIG. 118 is a diagram illustrating operation of still another system in the seventeenth embodiment.

FIG. 119 is a diagram of a conventional cryptographic communication system.

FIG. 120 is a flowchart of the operation of a conventional cryptographic communication system.

FIG. 121 is a view for explaining a process of sharing a common key in a conventional cryptographic communication system.

[Explanation of symbols]

1, 1b information terminal A, 2, 2b information terminal B, 3 relay station, 4 data transmission path, 5 voice transmission path, 6 communication path, 11 telephone A, 12 personal computer A, 13 telephone B,
14 personal computer B, 15 public telephone network, 16 Internet, 101 user input unit, 102 voice input / output unit,
102a voice input unit, 102b voice output unit, 103
Display unit, 104 user confirmation input unit, 105 hash generation unit, 106 voice encryption unit, 107 voice decryption unit, 108 transmission / reception unit, 108a transmission unit, 108b reception unit, 109 key pair generation unit, 110 secret key storage unit, 1
11 common key decryption unit, 112 common key storage unit, 113
Secret information decryption section, 114 secret information section, 128 communication mode, 201 user input section, 202 voice input / output section, 2
03 display unit, 204 user confirmation input unit, 205 hash generation unit, 206 voice encryption unit, 207 voice decryption unit, 208 transmission / reception unit, 209 common key generation unit, 21
0 common key storage unit, 211 public key storage unit, 212 common key encryption unit, 213 secret information encryption unit, 214, 22
8 storage unit, 215 secret information generation unit, 501 common key generation unit, 502 common key generation unit, 601 verification data conversion table, 602 verification data conversion table, 120
1 user input section, 1202 display section, 1203 hash generation section, 1204 data encryption section, 1205 data decryption section, 1206 program storage section, 1207 transmission / reception section, 1208 key pair generation section, 1209 secret key storage section,
1210 common key decryption unit, 1211 common key storage unit, 1
401 User input unit, 1402 display unit, 1403
Hash generation unit, 1404 Data encryption unit, 1405
Data decryption unit, 1406 Program storage unit, 140
7 transmission / reception unit, 1408 common key generation unit, 1409 common key storage unit, 1410 public key storage unit, 1411 common key encryption unit.

──────────────────────────────────────────────────続 き Continued on the front page (51) Int.Cl. ⁷ Identification code FI Theme coat ゛ (Reference) H04L 9/00 601E F-term (Reference) 5J104 AA01 AA16 EA19 JA03 KA16 NA02 NA12 PA02 5K067 AA33 BB04 DD17 DD24 EE02 FF02 FF23 HH21 HH24 HH36 9A001 BB03 BB04 CC03 CC05 DD10 EE03 FF01 GG22 HH15 HH16 HH18 HH23 HH30 JJ12 JJ25 KK56 LL03

Claims (7)

[Claims] 1. A method of sharing a common key between information terminals having data communication means and voice communication means and performing cryptographic communication by a common key method, comprising a first key having a secret key and a corresponding public key. A method of sharing a common key, characterized in that an operation of the information terminal of (a) when acquiring a common key for encrypted communication held by a second information terminal that is a partner of the encrypted communication includes the following steps. (1) a public key transmitting step in which the first information terminal transmits the public key to the second information terminal by data communication means; (2) the first information terminal receives the first key A common key transmitting step of encrypting the held common key using a public key of the information terminal, and transmitting the encrypted common key to the first information terminal by data communication means; One information terminal decrypts the received encrypted common key with the secret key of the first information terminal, and obtains first verification data from the decrypted common key and the public key of the first information terminal. (4) The second information terminal generates second verification data from the held common key and the public key of the first information terminal. Verification data generation step; (5) the above first and second information A verification data comparing step in which a terminal user mutually confirms each other by voice through the voice communication means, and further compares the first verification data and the second verification data with each other by voice. 2. A method for sharing a common key between information terminals having data communication means and voice communication means and performing cryptographic communication by a common key method, comprising the following steps: Method. (1) a common key sharing step in which the first and second information terminals performing mutual cryptographic communication share a common key for cryptographic communication by the Diffie-Hellman method via the data communication means when performing cryptographic communication; 2) a verification data generation step in which the first and second information terminals respectively generate first verification data and second verification data from the held common key; (3) the first and second information terminals A verification data comparing step in which a user of the information terminal mutually confirms each other by voice through the voice communication means, and further compares the first verification data and the second verification data by voice. 3. The method according to claim 1, wherein the first verification data and the second verification data are hashes generated in a predetermined procedure. 4. The first and second information terminals have a display unit for displaying at least a part of the hash, and in the verification data comparison step, each user compares the displayed hash. The common key sharing method according to claim 3, wherein: 5. The first and second information terminals have a verification data conversion table for associating a given numerical value with a specific character, graphic, or moving image, and the first verification data and the second verification data 3. The common key sharing method according to claim 1, wherein the hash value generated in a predetermined procedure is a character, a graphic, or a moving image in which the hash value is associated with the verification data conversion table. 6. The first and second information terminals have a verification data conversion table for associating a given numerical value with a specific sound, wherein the first verification data and the second verification data are 3. The common key sharing method according to claim 1, wherein the sound is a sound in which the hash value generated in the procedure is associated with the verification data conversion table. 7. The apparatus according to claim 1, further comprising a timer, wherein a warning is issued when the verification data comparing step of comparing the first verification data with the second verification data exceeds a set time of the timer. Item 4. The common key sharing method according to Item 1.