JP2862141B2 - Identification number-based key management device using conventional encryption - Google Patents

Description

Detailed Description of the Invention [Table of Contents] Overview Industrial application field Conventional technology Problems to be solved by the invention Means for solving the problem (FIG. 1) Operation (FIG. 1) Working example (FIG. 1) 2 to 5) Effect of the Invention [Summary] In a key management required for performing cryptographic communication using a conventional encryption, an identification number-based key management device using a conventional encryption that uses an identification number for key management. By using the password and identification number of the user and the identification number of the communication partner, the individual encryption communication and group communication can be easily realized at high speed by using a device that is one-way in the one that uses the conventional encryption. A reference password / reference identification number storage unit, comparing means for comparing the password and the identification number with the reference password and the reference identification number, and outputting a match signal when the two match. Ma A master key storage unit, a gate / means for outputting a master key when a coincidence signal is received from the comparing means, a combining means for combining a personal identification number and a communication partner identification number, and a master for storing combined identification number information from the combining means. A conventional cryptographic processing unit that generates a conventional encryption key by encrypting with a key, and an encryption device that encrypts outgoing plaintext data or decrypts encrypted incoming data using the encryption key are provided.

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an identification number-based key management device using a conventional encryption that uses an identification number for key management in key management required when performing cryptographic communication using a conventional encryption.

In general, an encryption communication system for performing communication by encrypting data is known, and encryption and decryption are performed by sharing the same encryption key between communicating parties.

2. Description of the Related Art Various methods have been proposed for an encryption communication method for encrypting data to be transmitted in order to protect the data. These methods are a conventional encryption method (Conventional Cryptosystem) and a public key encryption method (Public-key method). Cryptosystem).

The conventional encryption method is also called a secret key method,
The same key is secretly shared between entities, and various means for secretly delivering the key have been proposed.

In addition, the public key cryptosystem discloses an encryption key and keeps a decryption key secret. As this decryption key, one that is almost impossible to estimate from various public parameters has been used. I have.

In addition, a method of adding personal identification information such as a personal name or an employee number when generating an encryption key has been proposed.

[Problems to be Solved by the Invention] However, since the above-mentioned conventional encryption method requires a common encryption key between each entity, when there are many entities such as a large-scale network, Since the encryption keys corresponding to these entities are secretly managed, it becomes difficult to protect the encryption keys.

In the public key cryptosystem, an encryption key is made public and a decryption key is kept secret. Therefore, each entity only needs to store and manage only the decryption key precisely. When a public key file is required and there are many entities such as a large-scale network, it becomes difficult to manage the public key file. If this public key file is tampered with, there is a risk that a third party may pretend to be an entity, and if the public key is
It is as long as 512 bits, has the property that key data is random in nature, and it is necessary for communication parties to have different operation parameters, which makes the operation of the system cumbersome.

Therefore, research on an ID-based key management method of generating a key unique to a communication party using a more easily identifiable partner identification code, that is, an identification number (ID number) instead of a public key, and performing cryptographic communication using this key has been conducted. It is becoming active.

That is, in such an ID-based key management method,
Creates a one-way function using a complex matrix operation or exponentiation operation, generates a key for cryptographic communication that is difficult for a third party to estimate from the identification number, and shares this key between the communicating parties to perform cryptographic communication. Is realized.

By the way, it is conceivable to perform key management based on an identification number based on a conventional encryption, but in such a case, since the identification number is made public, there is a problem that any key can be generated by any communication party.

The present invention was created in such a situation, and has a one-way property using a conventional cryptosystem that has a high operation processing efficiency but can generate a common key by anyone. An identification number-based key management device using conventional cryptography that uses individual passwords, identification numbers, and communication partner identification numbers to easily realize individual encryption communication and group communication at high speed. It is intended to provide.

[Means for Solving the Problems] FIG. 1 is a principle block diagram of the present invention.

In FIG. 1, reference numeral 1 denotes a reference password / reference identification number storage unit, and this reference password / reference identification number storage unit 1 stores a reference password and a reference identification number for the user.

Reference numeral 2 denotes a comparator (comparing means). The comparator 2 compares the input password and identification number with the password and reference identification number stored in the reference password / reference identification number storage unit 1, respectively. If they match, a match signal is issued.

 Reference numeral 3 denotes a master key storage unit that stores a master key.

Reference numeral 4 denotes a gate circuit (gate means).
Is to output the master key from the master key storage unit 3 upon receiving the coincidence signal from the comparator 2.

Numeral 5 denotes a coupling circuit (coupling means) which couples the input personal identification number with the identification number of the communication partner. This coupling circuit 5 combines the input personal identification number with the communication partner. And an identification number / communication partner identification number combination storage unit for storing the identification numbers and the communication partner identification number in a required order, and a personal identification number and a communication partner identification number stored in the personal identification number / communication partner identification number combination storage unit. A hashing processing unit for performing a hashing process on the combined components is configured (claim 4).

Reference numeral 6 denotes a conventional cryptographic processing unit, which encrypts the connection identification number information from the connection circuit 5 with the master key passed through the gate circuit 4 to generate a conventional encryption key.

Reference numeral 7 denotes an encryption device, which encrypts outgoing plaintext data or decrypts encrypted incoming data using the encryption key generated by the conventional encryption processing unit 6 (the above-described components). Claims 1 and 4).

Then, these reference password / reference identification number storage unit 1, comparator 2, master key storage unit 3, gate circuit 4, coupling circuit 5,
The conventional cryptographic processing unit 6 and the cryptographic device 7 are built in an IC card.

Reference numeral 8 denotes an encryption key storage unit, which stores the encryption key generated by the conventional encryption processing unit (claim 3).

Note that two types of encryption keys, one for transmission and one for reception, may be prepared. In this case, first, the coupling circuit 5 couples the identification number of the communication party and the identification number of the communication partner in this order to generate the coupling identification number information for transmission. Select the incoming connection identification number information generation unit that generates the connection identification number information for incoming calls by combining in the order of the user identification numbers, and select one of the outgoing connection identification number information generation unit or the incoming connection identification number information generation unit And a conventional encryption processing unit 6
In the above, the outgoing connection identification number information from the outgoing connection identification number information generation unit is encrypted with the master key to generate the outgoing connection encryption key, and the incoming connection identification number information from the incoming connection identification number information generation unit. Is encrypted with the master key to generate an incoming encryption key.

It is also possible to provide an outgoing encryption key storage unit and an incoming encryption key storage unit for respectively storing the outgoing encryption key and the incoming encryption key generated by the conventional encryption processing unit 6 (claim 6).

Furthermore, if the input password and the identification number do not match the reference password and the reference identification number even after performing the comparison process in the comparison unit 2 a required number of times, the subsequent comparison process in the comparison unit 2 is prohibited. Means 21 may be provided, and a canceling means 22 for canceling the comparison prohibition by the prohibition means 21 by an external operation may be provided.

[Operation] In the above-described identification number-based key management device using the conventional encryption according to the present invention, when a password and an identification number are input to this device (this device is formed into an IC card according to claim 2), The comparator 2 compares the reference password and the reference identification number stored in the reference password / reference identification number storage unit 1 with the password and the identification number. If the two match, a match signal is output. Will be issued.

If a match signal is output from the comparator 2, the gate circuit 4 receives the match signal and outputs a master key from the master key storage unit 3.

On the other hand, in addition to the password and the identification number of the user, the identification number of the communication partner is also input to the apparatus, and the input identification number and the identification number of the communication partner are connected by the connection circuit 5. In the connection circuit 5, the input personal identification number and the communication partner identification number are stored in the personal identification number / communication partner identification number connection storage unit in a required order, and the personal identification number and the communication partner identification number are stored. A hashing process is performed by the hashing processing unit on a combination of the personal identification number and the communication partner identification number stored in the communication partner identification number combination storage unit (claim 4).

Thereafter, the conventional cryptographic processing unit 6 encrypts the connection identification number information from the connection circuit 5 with the master key that has passed through the gate circuit 4 to generate a conventional encryption key.
In this case, when the encryption key storage unit 8 is provided, the encryption key generated by the conventional encryption processing unit is stored in the encryption key storage unit 8.

Finally, the encryption device 7 uses the conventional encryption processing unit 6
The encryption of the outgoing plaintext data or the decryption of the encrypted incoming data is performed using the encryption key generated in (1) and (2).

Note that two types of encryption keys, one for transmission and one for reception, can be prepared. In this case, however, the outgoing connection identification number information generation unit of the connection circuit 5 first generates the personal identification number and the identification number of the communication partner. Combined in order to generate outgoing combined identification number information, and in the incoming combined identification number information generating section, combine the communication partner's identification number and personal identification number in this order to generate incoming combined identification number information and select it. The section selects either the outgoing connection identification number information generating section or the incoming connection identification number information generating section.

Thereafter, in the conventional encryption processing unit 6, the outgoing connection identification number information from the outgoing connection identification number information generation unit is encrypted with the master key to generate the outgoing connection encryption key, and the incoming connection identification number information generation unit And encrypts the incoming connection identification number information with the master key to generate an incoming encryption key (claim 5).

The outgoing encryption key and the incoming encryption key generated by the conventional encryption processing unit 6 are stored in the outgoing encryption key storage unit and the incoming encryption key storage unit, respectively.

By the way, when the input password and the identification number do not match the reference password and the reference identification number after performing the comparison process in the comparison unit 2 a required number of times, the prohibiting means 21 performs the subsequent comparison in the comparison unit 2. The prohibition of the processing is performed, and such a prohibition state can be released by the release means 22 by an external operation (claim 7).

Embodiment An embodiment of the present invention will be described below with reference to the drawings.

Before describing the present apparatus, the principle of the key management for the entity will be briefly described. First, as shown in FIG. 5, a plurality of (5 in this example) entities A to E are connected to each other via a communication path to constitute a network. The encryption key between the entity B and the entity B includes a key K _AB from the entity A to the entity B and a key K _BA from the entity B to the entity A. Similarly, there are two types of keys between the other communication parties. Exist one by one.

 The key between the communicating parties is as follows.

_{K AB = E K (PW A} , ID A, ID B) K AC = E K (PW A, ID A, ID C) K AD = E K (PW A, ID A, ID D) K AE = E K _{(PW A, ID A, ID} E) K BA = E K (PW B, ID B, ID A) K BC = E K (PW B, ID B, ID C) K BD = E K (PW B, ID _{B, ID D) K BE =} E K (PW B, ID B, ID E) K CA = E K (PW C, ID C, ID A) K CB = E K (PW C, ID C, ID B) _{K CD = E K (PW C} , ID C, ID D) K CE = E K (PW C, ID C, ID E) K DA = E K (PW D, ID D, ID A) K DB = E K _{(PW D, ID D, ID} B) K DC = E K (PW D, ID D, ID C) K DE = E K (PW D, ID D, ID E) K EA = E K (PW E, ID _{E, ID A) K EB =} E K (PW E, ID E, ID B) K EC = E K (PW E, ID E, ID C) K ED = E K (PW E, ID E, ID D) here, E is an encryption function, PW is the password, K is the encryption key, for example, _{K AB = E K (PW A} , ID A, ID B) _{is, PW A, ID A, ID} B
Means that an encryption key K _AB is obtained by encrypting with an encryption function E _K with

By the way, an entity must have an outgoing and incoming cryptographic keys for cryptographic communication with a connected entity. In this apparatus, its own password PWi, identification number IDi, and communication partner , An outgoing encryption key Kij and an inbound encryption key Kji for communication with the communication partner are generated from the information, and the encryption key for outgoing plaintext data is encrypted using these encryption keys. It can decrypt encrypted or encrypted incoming data.

Below, this device (this corresponds to each entity)
Will be described in detail.

First, as shown in FIG. 2, the present apparatus includes a reference password / reference identification number storage unit 1, a comparator 2, a master key storage unit 3, a gate circuit 4, a coupling circuit 5, a first conventional encryption processing unit 6, It has a two-purpose cryptographic processing unit 6 ', a cryptographic device 7, and a cryptographic key storage unit 8. All of these members are provided in an IC card as a medium having an arithmetic function and a storage function (this IC card cannot physically be seen inside).

Here, the reference password / reference identification number storage unit 1
It stores a reference password PWri and a reference identification number IDri for the user, and for example, a ROM is used. The reference password PWri and the reference identification number IDri are stored by the center in which the entity is registered. That is, when the IC card is issued, the center writes and passes the reference password PWri and the reference identification number IDri. Since these pieces of information are written in the IC card, it goes without saying that the inside cannot be physically excluded as described above.

The comparator 2 compares the input password PWi and the identification number IDi with the reference password PWri and the reference identification number IDri stored in the reference password / reference identification number storage unit 1, respectively. Outputs a coincidence signal. If they do not match,
A retry instruction signal is output to the user.

Further, the comparison process in the comparator 2 is performed a predetermined number of times (for example,
Times), the password PWi and the identification number IDi and the reference password PWri and the reference identification number IDri
If they do not match, all IC card functions are stopped. That is, even if the comparator 2 performs the comparison process a required number of times, the input password PWi
If the identification number IDi does not match the reference password PWri and the reference identification number IDri, the comparison unit 2 has a function of a prohibition unit 21 for prohibiting the subsequent comparison processing.

The comparator 2 is provided with a release unit for releasing the comparison inhibition by the inhibition unit 21 by an operation from the outside (center).
It also has 22 functions. That is, when random number data managed only by the center is input to the comparator 2 of this IC card,
The function stop is released by the operation of the release means 22. For this purpose, the release means has a random number storage device (ROM) for restart.

The master key storage unit 3 stores a master key Km.
ROM is used.

The gate circuit 4 outputs the master key Km from the master key storage unit 3 when receiving the coincidence signal from the comparator 2.

The connecting circuit 5 connects the input personal identification number IDi and the communication partner identification number IDj, and connects the personal identification number IDi and the communication partner identification number IDj in this order as shown in FIG. Outgoing connection identification number information generating section 51 for generating outgoing connection identification number information IDj || IDj;
Combined ID number information generating section 52 for incoming call which generates combined ID number information for incoming call IDj || IDi by combining in the order of IDj and personal identification number IDi, and combined ID number information for outgoing call 51 or combined ID number for incoming call It is configured to include a selection unit 53 for selecting one of the information generation units 52.

Further, the outgoing connection identification number information generation unit 51 stores a personal identification number IDi and a communication partner identification number IDj. Memory 511 and this FIFO memory 5
Personal identification number IDi and communication partner identification number IDj stored in step 11
And a hashing processing unit 512 that performs a hashing process on a combination of the two.

In addition, the incoming connection identification number information generation unit 52 serves as a personal identification number / communication partner identification number combination storage unit that stores these information in the order of the input communication partner identification number IDj and the personal identification number IDi. FIFO memory 521 and this FIFO memory 5
Communication partner identification number IDj and personal identification number IDi stored in 21
And a hashing processing unit 522 that performs a hashing process on a combination of the two.

As a result, the coupling circuit 5 has two FIFO memories (both sides).

The hashing process is a process of converting a plaintext space into a required condensed cryptographic space. To perform such a process, the hashing processing units 512 and 522 convert the initial vector IV into initial information as shown in FIG. , And also has an OFB type conventional encryption processing unit 5121, 5221 that receives the combined identification number information IDi || IDj or IDj || IDi as a key input and feeds back the output. In this way, an output subjected to hashing processing (hashing output) is obtained.

As shown in FIG. 3, the selection unit 53 has selectors 531 and 532 provided on the input and output sides of the outgoing connection identification number information generating unit 51 and the incoming connection identification number information generating unit 52, respectively.

The selector 531 receives the outgoing / incoming call switching control signal, and stores the personal identification number IDi,
Switching is performed so that data is input in the order of the identification number IDj of the communication partner, and at the time of storage in the FIFO memory 521, switching is performed so that data is input in the order of the identification number IDj of the communication partner and the principal identification number IDi.

Further, the selector 532 receives the outgoing / incoming call switching control signal, switches to the outgoing combined identification number information generating section 51 when the outgoing combined identification number information is desired, and switches to the incoming incoming combined identification number information generating section 52. Is switched to.

The first common cryptographic processing unit 6 shown in FIG. 2 encrypts the outgoing connection identification number information from the outgoing connection identification number information generation unit 51 of the connecting circuit 5 with the master key Km and transmits the outgoing encryption key Kij '.
And a connection identification number information generating section 52 for incoming calls.
Is encrypted with the master key Km to generate an incoming call encryption key Kji '.

The encryption key storage unit 8 stores the transmission encryption key Kij and the reception encryption key Kji generated by the first conventional cryptographic processing unit 6, respectively. For this purpose, the transmission key register as the transmission encryption key storage unit is used. 81 and an incoming key register 82 as an incoming encryption key storage unit. The switching control of these registers 81 and 82 is performed on each of the registers 81 and 82 in a mode in which the transmission / reception switching control signal is mutually inverted (that is, a control signal is input to one register via the inverter 83). This is done by

The second conventional cryptographic processing unit 6 ′ performs output feedback processing on the outgoing encryption key Kij ′ or the incoming encryption key Kji ′ to perform processing similar to the hashing processing described above. The output from the processing unit 6 'is input to the encryption device 7 as the outgoing encryption key Kij or the incoming encryption key Kji.

The encryption device 7 encrypts the outgoing plaintext data Data or decrypts the encrypted incoming data CR using the above-mentioned encryption key Kij or Kji. For this purpose, the outgoing encryption device 71 and the incoming encryption device 72 have.

According to the above configuration, first, a communication party who wants to join the system goes to the center, registers his password PWi,
At this time, the center receives an IC card built in the device shown in FIG. 2 (accordingly, this IC card has a built-in encryption algorithm and a secret key).

After that, generate a communication key in this device by the following procedure,
Performs encrypted communication.

That is, an IC card built into the device is set in a communication device, and the password PWi and the identification number IDi are input through, for example, a keyboard or the like provided with the communication device. As a result, the reference password PWri and the reference identification number IDri stored in the reference password / reference identification number storage unit 1 are stored in the comparator 2.
Is compared with the password PWi and the identification number IDi, and if they match, a match signal is issued.

If a match signal is output from the comparator 2, the match signal is input to the gate circuit 4, whereby the gate circuit 4 outputs the master key from the master key storage unit 3.

On the other hand, this device has its own password PWi and identification number I
In addition to Di, the identification number IDj of the communication partner is also input. The input personal identification number IDi and the identification number IDj of the communication partner are connected by the connection circuit 5. And this coupling circuit 5
In the outgoing connection identification number information product 51, the outgoing connection identification number information is generated by combining these in the order of the principal identification number IDi and the communication partner identification number IDj, and the incoming connection identification number information. The generation unit 52 combines the identification number IDj of the communication partner and the personal identification number IDj in this order to generate the combined identification number information for incoming calls, and the selecting unit 53
, One of the outgoing connection identification number information generating section 51 and the incoming connection identification number information generating section 52 is selected.

When generating the above-mentioned combined identification number information, the FIFO is used for both outgoing and incoming calls.
In the memories 511 and 521, the input personal identification number IDi and the communication partner identification number IDj are stored in a required order (IDi || IDj or IDj || ID
A hashing processing section 512,522 performs a hashing process on the combination of the personal identification number and the communication partner identification number stored in i) and stored in the FIFO memories 511,521.

Thereafter, in the first common cryptographic processing unit 6, the outgoing connection identification number information from the outgoing connection identification number generation unit 51 is encrypted with the master key Km to generate the outgoing encryption key Kij ', and The incoming combination identification number information from the identification number information generation unit 52 is encrypted with the master key Km to generate the incoming encryption key Kji '.

Then, the outgoing encryption key Kij 'and the incoming encryption key Kji' generated by the first conventional encryption processing unit 6 are stored in the outgoing key register 81 and the incoming key register 82, respectively.

Thereafter, the second conventional cryptographic processing unit 6 'performs output feedback processing on the outgoing encryption key Kij' and the incoming encryption key Kji 'stored in the outgoing key register 81 and the incoming key register 82 to perform outgoing transmission. A cryptographic key Kij and an incoming cryptographic key Kji are generated, and finally, the cryptographic device 7 uses the outgoing cryptographic key Kij and the incoming cryptographic key Kji generated by the second conventional cryptographic processing unit 6 ′ to transmit a call. decrypting the encrypted or encrypted incoming data C _R plaintext data (plaintext input) a Date is performed. Thus, outgoing plaintext data Date are both sent to the communication partner as a ciphertext output C _T, encrypted incoming data (ciphertext input) C _R is obtained as a decoded output Date.

In this way, it is possible to provide a one-way property to the one using the conventional cryptography which has a high calculation processing efficiency but can generate a common key by anyone, thereby enabling the password PWi of the user to be used. Identification number IDi and identification number of communication partner
By using IDj, individual encryption communication and group communication can be easily realized at high speed.

By the way, the comparison process in the comparison unit 2 is performed a required number of times (for example, 3
If the input password PWi and the identification number IDi and the reference password PWri and the reference identification number IDri do not match each other, the prohibiting means 21 may prohibit the subsequent comparison processing in the comparing unit 2. This prohibition state can be canceled by the cancellation means 22 by inputting random number data at the center.

As a result, communication security is improved, and the same IC card can be easily reproduced.

In addition, the encryption key for transmission and the encryption key for reception can be shared. In this case, the configurations of the coupling circuit 5 and the encryption key storage unit 8 are further simplified. That is, the coupling circuit 5 includes a FIFO memory (a personal identification number / communication partner identification number coupling storage unit) that stores the input personal identification number IDi and the communication partner identification number IDj in a required order, and the FIFO memory. May be provided with a hashing processing unit for performing a hashing process on the combination of the personal identification number and the communication partner identification number stored in the above. Also, the encryption key storage unit 8 may have only one register.

[Effects of the Invention] As described above in detail, according to the identification number-based key management device using the conventional cryptography of the present invention (claim 1), the one using the conventional signal can be made unidirectional. Thus, there is an advantage that individual encryption communication and group communication can be easily realized at high speed by using the password and the identification number of the user and the identification number of the communication partner.

According to the second aspect of the present invention, there is provided an identification number-based key management device using a conventional encryption, wherein a reference password / reference identification number storage unit, a comparison unit, a master key storage unit, a gate unit, a combining unit, a conventional encryption processing unit, Since the encryption device is built in the IC card, the device can be made compact, and since the inside cannot be physically seen from the outside, there is an advantage that leakage of secret information can be prevented.

In the identification number-based key management apparatus using the conventional encryption according to the present invention, since the encryption key storage unit for storing the encryption key generated by the conventional encryption processing unit is provided, the encryption key is securely stored. There is an advantage that can be stored.

In the identification number-based key management device using the conventional cryptography according to the present invention, the connecting means stores the input personal identification number and the communication partner identification number in a required order. A communication partner identification number combination storage unit, and a hashing processing unit for performing hashing processing for combining the personal identification number and the communication partner identification number stored in the personal identification number / communication partner identification number combination storage unit. With this configuration, the identification number information can be standardized to information of a predetermined length. Further, in the identification number-based key management device using the conventional encryption according to the present invention as set forth in claim 5, the combining means includes: An outgoing connection identification number information generating unit that generates outgoing connection identification number information by combining in the order of the principal identification number and the identification number of the communication partner; Combination identification number information generation unit for receiving the combination identification number information, and a selection unit for selecting one of the combination identification number information generation unit for transmission or the combination identification number information for reception In addition, in the conventional cryptographic processing unit, the outgoing connection identification number information from the outgoing connection identification number information generation unit is encrypted with the master key to generate the outgoing connection encryption key, and Is configured to generate the incoming encryption key by encrypting the incoming connection identification number information with the master key, so that there is an advantage that the outgoing and incoming encryption keys can be generated separately.

In the identification number-based key management device using the conventional encryption according to the present invention, the transmission encryption key storage unit for storing the transmission encryption key and the reception encryption key generated by the conventional encryption processing unit, and Since the incoming encryption key storage unit is provided, there is an advantage that each of the outgoing and incoming call encryption keys can be reliably stored.

In the identification number-based key management apparatus using the conventional encryption according to the present invention, the password and the identification number, the reference password and the reference identification number, which have been input even after performing the comparison process by the comparison means a required number of times, are obtained. If the two do not match, a prohibition means for prohibiting the subsequent comparison processing by the comparison means and a release means for releasing the prohibition of comparison by the prohibition means by an external operation are provided, so that communication security is improved. And the device can be easily regenerated.

[Brief description of the drawings]

1 is a block diagram showing the principle of the present invention, FIG. 2 is a block diagram showing an embodiment of the present invention, FIG. 3 is a block diagram showing an example of a coupling circuit, and FIG. 4 is a block diagram showing an example of a hashing circuit. FIG. 5 is a diagram for explaining a network to which a plurality of entities have joined. In the figure, 1 is a reference password / reference identification number storage unit, 2 is a comparator, 3 is a master key storage unit, 4 is a gate circuit, 5 is a coupling circuit, 6 is a first common encryption processing unit, and 6 ′ is a second encryption unit. A conventional cryptographic processing unit, 7 is an encryption device, 8 is an encryption key storage unit, 21 is a prohibition unit, 22 is a release unit, 51 is a transmission connection identification number information generation unit, 52 is a reception connection identification number information generation unit, 53 Is a selection unit, 71 is an outgoing encryption device, 72 is an incoming encryption device, 81 is an outgoing key register as an outgoing encryption key storage unit, 82 is an incoming key register as an incoming encryption key storage unit, 83 is an inverter, Reference numerals 511 and 521 denote FIFO memories serving as personal identification number / communication partner identification number combination storage units, 512 and 522 denote hashing processing units, and 5121 and 5221 denote conventional encryption processing units.

Continuation of front page (56) References JP-A-3-145835 (JP, A) JP-A-2-56136 (JP, A) JP-A-63-280530 (JP, A) (58) Fields investigated (Int .Cl. ⁶ , DB name) H04L 9/00-9/38 G09C 1/00-5/00 JICST file (JOIS)

Claims (7)

(57) [Claims] 1. A reference password / reference identification number storage unit (1) for storing a reference password and a reference identification number for a user, and a reference password / reference identification number storage unit (1) for storing an input password and an identification number. A comparison means (2) for comparing the reference password and the reference identification number stored in the storage device with each other and outputting a match signal when the two match, a master key storage unit (3) for storing a master key, Gate means (4) for outputting the master key from the master key storage section (3) upon receipt of the coincidence signal from the comparing means (2); and the input personal identification number and communication partner identification number (5) for encrypting the information, and encrypting the binding identification number information from the combining means (5) with the master key passed through the gate means (4) to generate a conventional encryption key. And an encryption device (7) for encrypting outgoing plaintext data or decrypting encrypted incoming data using the encryption key generated by the conventional encryption processing unit (6). An identification number-based key management device using conventional encryption, characterized in that: 2. A reference password / reference identification number storage unit (1), a comparison unit (2), a master key storage unit (3), a gate unit (4), a combining unit (5), and a conventional encryption processing unit (2). 6. An identification number-based key management device using conventional encryption according to claim 1, wherein the encryption device is built in the IC card. 3. An identification using a conventional encryption according to claim 1, further comprising an encryption key storage unit for storing the encryption key generated by said conventional encryption processing unit. Number-based key management device. 4. A personal identification number / communication partner identification number coupling storage unit (511,521) for storing the input personal identification number and the communication partner identification number in a required order. The personal identification number / communication partner identification number combination storage unit (511,
2. The conventional cryptosystem according to claim 1, further comprising a hashing processing section (512, 522) for performing hashing processing on a combination of the personal identification number stored in step 521) and the communication partner identification number. ID-based key management device that uses a password. 5. An originating connection identification number information generating section (51) for generating an originating connection identification number information by connecting an identification number and an identification number of a communication partner in this order. Combined ID number generator for incoming call (52), which generates combined ID information for incoming calls by combining the identification number of the other party and the identification number in order, and the combined ID number information for outgoing call (51) or incoming call A selection section (53) for selecting one of the identification number information generating sections (52); and the common cryptographic processing section (6) includes: The outgoing connection identification number information is generated by encrypting the outgoing connection identification number information with the master key, and the incoming connection identification number information from the incoming connection identification number information generating section (52) is used in the master key. Encrypt to generate incoming encryption key Characterized in that it is configured to, identification number based key management apparatus using the common key cryptosystem according to claim 1, wherein. 6. An outgoing encryption key storage section (81) and an incoming encryption key storage section (82) for respectively storing the outgoing encryption key and the incoming encryption key generated by the conventional encryption processing section (6).
6. An identification number-based key management device using conventional cryptography according to claim 5, wherein: 7. When the inputted password and identification number and the reference password and reference identification number do not match with each other even after performing the comparison process in the comparison means (2) a required number of times, the comparison means (2). A prohibition means (21) for prohibiting a subsequent comparison process from being executed, and a release means (22) for releasing the prohibition of comparison by said prohibition means (21) by an external operation. An identification number-based key management device using the conventional cryptography according to 1.