JP7581838B2 - Encryption key management method and device, and communication device - Google Patents

Description

The present invention relates to a communication system that generates and shares encryption keys used to encrypt communications, and in particular to a method and device for managing encryption keys, and a communication device.

In the field of optical communications, quantum key distribution (QKD) is known as a technology that enables secure sharing of encryption keys (random number sequences) between communication devices through optical communications using single photons. By using single photons, it is possible to quantum-mechanically guarantee that the key will not be leaked, achieving a high level of confidentiality, and it is expected to be used for transmitting important confidential information.

In such a QKD system, first, a transmitter (Alice) and a receiver (Bob) authenticate each other to determine whether they are legitimate communication partners using an authentication key (initial key) embedded in advance between them. If this initial authentication is successful, a key generation process is initiated between Alice and Bob. This authentication process is extremely important for determining whether the key generation process is initiated between legitimate devices, and therefore it is desirable to discard the authentication key once it has been used for a certain period of time or when a certain amount of communication has been reached. For example, Patent Document 1 describes an example in which part of the encryption key generated by the key generation process is used as the authentication key for the next authentication process.

Also, in a QKD system, how to continue generating encryption keys when a failure occurs is an extremely important issue. For example, Patent Document 2 recognizes the problem of mismatches occurring in encryption keys shared between nodes when a failure occurs, and proposes one example of a solution to this problem. This solution involves not discarding the encryption keys that have been shared up until now, but keeping them as they are, checking whether the encryption keys shared between the nodes match or do not match, and deleting only the encryption keys that do not match. It is stated that this makes it possible to efficiently generate encryption keys after recovery, without wasting the encryption keys that have been generated up until now.

Patent Publication 2013-543338 Patent Publication 2015-032962

However, if one of the communication devices that share an encryption key fails, it is not necessarily possible to read the encryption key from the failed communication device. The method described in Patent Document 2 assumes that the encryption key is readable, but even if it is readable, the security of such an encryption key should be considered to be greatly compromised.

Furthermore, when a communication device is used as a replacement for a broken communication device, the initial authentication key embedded in the replacement device is not known to the other communication device. For this reason, the initial authentication key must be sent to the other party to prove that it is a legitimate communication partner. However, a high level of confidentiality is required for sending the authentication key to start key generation. It is clear that a method of storing the data on a physical storage medium such as a USB memory and transporting it to the other party would require a great deal of cost to avoid the risk of data theft during transport and to ensure the reliability of the transporter.

The object of the present invention is to provide an encryption key management method and device, as well as a communication device, that can reduce the risk of leakage associated with the distribution of authentication keys.

According to a first aspect of the present invention, there is provided an encryption key management device that manages communication devices that generate and share encryption keys consumed in encrypted communication, and is characterized in having: a memory unit that receives from the communication device and stores the encryption keys remaining after the encryption keys generated between the communication device and a counterpart communication device are extracted as authentication keys; a control unit that controls the key consumption of the communication device so that the encryption keys of the communication device do not fall below a predetermined amount; and a recovery control unit that returns a predetermined amount of the encryption keys from the encryption keys remaining in the memory unit as a new authentication key to a communication device that initiates generation of encryption keys with the counterpart communication device.
According to a second aspect of the present invention, a communication device managed by a key management device has a key generation unit that generates an encryption key to be consumed for encrypted communication with other communication devices, a first memory unit that stores the encryption key shared with the other communication devices, a second memory unit that stores an authentication key for key generation by the key generation unit, and a control unit that controls the key generation unit, the first memory unit, and the second memory unit, wherein the control unit uploads the remaining encryption key after extracting a portion of the encryption key stored in the first memory unit as the authentication key to the key management device, and when starting a new key generation, downloads a predetermined amount of the uploaded encryption key from the key management device as an authentication key and stores it in the second memory unit, and uses the downloaded authentication key to authenticate the key generation by the key generation unit.
According to a third aspect of the present invention, there is provided an encryption key management method for managing a communication device that generates and shares encryption keys consumed in encrypted communication, the method comprising the steps of: storing, in a memory unit, an encryption key remaining after extracting an encryption key from the encryption keys generated between the communication device and a counterpart communication device as an authentication key; a control unit controlling key consumption of the communication device so that the encryption key of the communication device does not fall below a predetermined amount; and a recovery control unit returning, as a new authentication key, a predetermined amount of the encryption key from the encryption keys remaining in the memory unit to a communication device that initiates generation of an encryption key with the counterpart communication device.
According to a fourth aspect of the present invention, there is provided a program that causes a computer to function as an encryption key management device that generates and manages a communication device that generates and shares encryption keys consumed in encrypted communication, and is characterized in that the program implements in the computer the following functions: a function of storing in a memory unit the encryption key remaining after extracting an authentication key from the encryption key generated between the communication device and a counterpart communication device; a function of controlling the key consumption of the communication device so that the encryption key of the communication device does not fall below a predetermined amount; and a function of returning a predetermined amount of the encryption key from the encryption key remaining in the memory unit as a new authentication key to a communication device that initiates generation of an encryption key with the counterpart communication device.

According to the present invention, the encryption key secured by the key management device is returned to the communication device as an authentication key when a failure is recovered, thereby reducing the risk of leakage associated with the distribution of authentication keys.

FIG. 1 is a block diagram for explaining the configuration of a key management system according to an embodiment of the present invention. FIG. 2 is a block diagram showing an example of a key management method in the communication system according to the present embodiment. FIG. 3 is a block diagram showing the circuit configuration of a key management device and a communication device according to an embodiment of the present invention. FIG. 4 is a flowchart showing recovery control in the key management method according to this embodiment. FIG. 5 is a flowchart showing key consumption control in the key management method according to this embodiment. FIG. 6 is a diagram showing an example of a key generation protocol executed between Alice and Bob. FIG. 7 is a network diagram showing a schematic configuration of a QKD system using a key management device according to one embodiment of the present invention.

<Overview of the embodiment>
According to an embodiment of the present invention, remaining encryption keys generated in a communication device are uploaded to a key management device, and the key management device controls consumption of the keys so that the remaining amount of the encryption keys does not fall below a predetermined amount. When a failure occurs in a communication device, the key management device returns a part of the remaining encryption keys as an authentication key to a communication device that has been restored by a substitute device or to a communication device that has been restored from the failure. Since the remaining encryption keys are shared with a communication device on the other side, by returning the encryption key secured by the key management device as an authentication key when the failure is restored, it is possible to substantially eliminate the risk of leakage associated with the distribution of authentication keys.

The following describes in detail the embodiments and examples of the present invention with reference to the drawings. However, the components described in the following embodiments are merely examples, and are not intended to limit the technical scope of the present invention to these alone.

1. One embodiment 1.1) System configuration In one embodiment of the present invention, a communication device has a key generation function for sharing an encryption key with a partner communication device and an encryption communication function for performing encrypted communication using the encryption key, and both communication devices are managed by their own key management devices. Hereinafter, a method for managing an authentication key when one communication device breaks down and is restored will be described.

As shown in FIG. 1, the communication device 10 has a key generation unit 101 and an encryption communication unit 102, with the current device 10.1 being the communication device 10 that is normally used and the alternative device 10.2 being the communication device 10 that takes over in the event of a breakdown in the current device 10.1. Therefore, the current device 10.1 and the alternative device 10.2 are communication devices that basically have the same configuration, and below, blocks that have the same functions are given the same reference numbers, with the current device and the alternative device being distinguished by adding ".1" or [.2] to the end of the same reference numbers.

The key generation unit 101 is connected to the key generation unit of the other communication device via an optical transmission line OpF, and generates an encryption key K(11) to be shared with the other key generation unit according to a specified key generation protocol. An initial authentication key KA1 for starting key generation is embedded in advance in the current device 10.1, and the key generation unit 101.1 starts a key generation sequence with the key generation unit of the other communication device using the initial authentication key KA1. Once used, the authentication key KA1 is discarded, and the authentication key KA(11) is used for the next key generation.

As described below, the authentication key KA(11) is a random number extracted from the encryption key K(11) generated by the key generation unit 101.1, and is updated each time it is used by extracting a new random number from the encryption key K(11). The remaining random numbers of the encryption key K(11) are uploaded to the key management device 20.

In the key management device 20, the encryption key memory 201 holds the encryption key uploaded from the active device 10.1. The key consumption control unit 202 sends the encryption key used for encryption from the held encryption keys to the encryption communication unit 102.1 of the active device 10.1, and controls the key consumption of the encryption communication unit 102 so that the amount of key remaining in the encryption key memory 201 does not fall below a predetermined amount. In this way, when the active device 10.1 is operating normally, an encryption key is generated between the key generation unit 101.1 of the active device 10.1 and the key generation unit of the other communication device, and encrypted communication is performed between the encryption communication unit 102 and the other encryption communication unit using the encryption key sent from the key management device 20.

When the current device 10.1 fails to operate normally due to a failure of the current device 10.1 or a fault in the line in use, the recovery control unit 203 of the key management device 20 detects the failure and starts control to switch from the current device 10.1 to the alternative device 10.2 so that key generation and encrypted communication can continue. More specifically, when the recovery control unit 203 detects the failure, it extracts a new authentication key from the encryption key in the encryption key memory 201 and sends it to the alternative device 10.2. When the key generation unit 101.2 of the alternative device 10.2 receives a new authentication key KA (21) from the key management device 20, it starts key generation to generate an encryption key K (21) between the key generation unit of the other communication device using the new authentication key KA (21). The operation of the alternative device 1.2 from this point on is the same as that of the current device 10.1. That is, an authentication key KA (21) is extracted from an encryption key K (21) generated by the key generation unit 101.2, and the authentication key KA (21) is updated by being newly extracted from the encryption key K (21) each time it is used. The remaining random numbers of the encryption key K (21) are uploaded to the key management device 20. In addition, the key consumption control unit 202 executes key transmission and key consumption control for the encryption communication unit 102 of the replacement device 10.2 in the same manner as for the encryption communication unit 102 of the current device 10.1.

In FIG. 1, the encryption communication unit 102 is provided in the communication device 10, but this is not limited thereto, and a similar encryption communication function may be provided as a separate device. That is, the communication device 10 may only have a key generation function, and the encryption communication unit 102 that consumes the generated encryption key may be provided independently of the communication device 10. In addition, in FIG. 1, when the active device 10.1 breaks down, it is restored using the substitute device 10.2, but this is not limited thereto. For example, when the active device 10.1 recovers from a failure, the active device 10.1 may similarly download an encryption key with a key amount Kth from the key management device 20 and use it as an authentication key to start key generation. In this case, the key management operation of the key management device 20 and the key generation start operation of the active device 10.1 are the same as described above.

1.2) Key Management As shown in FIG. 2, the key generation unit 101 of the communication device 10 shares the encryption key K with the key generation unit of the other communication device through the optical transmission path OpF according to a predetermined key generation procedure. That is, the same encryption key K is generated and stored in the other communication device according to the predetermined key generation procedure. Therefore, by cutting out a part of the encryption key K and using it as an authentication key KA for starting the next key generation, it is possible to mutually authenticate that the other communication device is a legitimate communication device. A part of the encryption key K thus generated, which has high security, is cut out as the authentication key KA, and the remaining encryption key is uploaded to the key management device 20. The method of generating the encryption key K is not limited, but the higher the confidentiality, the more desirable it is.

The encryption key uploaded in the key management device 20 is stored in the encryption key memory 201. The key consumption control unit 202 controls the encryption method in the encryption communication unit 102 of the communication device 10, and extracts and sends the encryption key used in the encryption communication unit 102 from the encryption key in the encryption key memory 201. The key consumption control unit 202 also inputs the remaining amount of key in the encryption key memory 201 from the remaining amount monitor 204, and controls the key consumption of the encryption communication unit 102 so that the remaining amount of encryption key 201 does not become equal to or less than a predetermined value Kth. The predetermined value Kth corresponds to the amount of key that can be used as the authentication key KA, as described below.

For example, the encryption device E of the encryption communication unit 102 encrypts the transmission data using the encryption key sent from the key management device 20, and conversely, the decryptor D decrypts the encrypted data received from the other communication device using the encryption key sent from the key management device 20. The encryption keys consumed in the encryption and decryption operations of the encryption device E and the decryptor D are extracted from the encryption key memory 201 and supplied to the encryption communication unit 102. Since the amount of encryption key consumption differs depending on the encryption method, the key consumption control unit 202 can adjust the amount of key consumption by changing the encryption method of the encryption communication unit 102. Therefore, the key consumption control unit 202 can control the remaining amount of the encryption key 201 not to fall below a predetermined value Kth by changing the encryption method of the encryption communication unit 102 or by stopping the encryption/decryption operation itself.

By thus maintaining the remaining capacity of the encryption key memory 201 at a predetermined amount Kth or more, the encryption key remaining in the encryption key memory 201 can be used as a new authentication key KA. For example, when a failure occurs in the communication device 10 and recovery is achieved by switching to a substitute device, or when the communication device 10 recovers from the failure, the recovery control unit 203 extracts an encryption key required for authentication from the remaining key in the encryption key memory 201 and downloads it to the communication device 10. The key generation unit 101 of the communication device 10 uses the downloaded encryption key as the authentication key KA and starts key generation with the other communication device. As described above, a part of the encryption key K generated by the key generation unit 101 is extracted as the authentication key KA, and the remainder is uploaded to the key management device 20, and the encryption communication unit 102 executes the encryption communication by the encryption key sending and key consumption control of the key consumption control unit 202. Note that the predetermined remaining capacity Kth of the encryption key memory 201 is the same length as the authentication key KA, and varies depending on the conditions, but as an example, it is about 5 kbits long.

1.3) Effects As described above, according to this embodiment, an encryption key shared with a communication partner by a predetermined key generation process is uploaded to a key management device, and the key management device controls key consumption in encrypted communication so that the remaining amount of the uploaded encryption key does not become equal to or less than a predetermined amount. If a failure occurs in a communication device, the key management device returns a part of the remaining encryption key to a substitute device or a communication device that has recovered from the failure as an initial authentication key, so that the substitute device or the recovered communication device can start new key generation using the initial authentication key. This makes it possible to substantially eliminate the risk of leakage associated with the distribution of authentication keys.

2. One embodiment A key management device and a communication device according to one embodiment of the present invention will be described with reference to Figures 3 to 7. In this embodiment, a communication device that performs key generation and an encryption communication device that consumes the generated encryption key are provided in separate units.

As illustrated in FIG. 3, the key management device 200 according to this embodiment manages the encryption keys uploaded from the communication device 100, and downloads to the communication device 100 an authentication key for starting key generation when the current communication device 100 recovers from a failure or the like, or when the current communication device 100 recovers by being switched to an alternative communication device 100. The key management device 200 also controls the key consumption of the encryption communication device 300, and sends the encryption keys required for encryption/decryption to the encryption communication device 300.

As already mentioned, the key generation unit 101 of the communication device 100 authenticates the authenticity of the other key generation unit using the authentication key stored in the authentication key memory 103, and starts the key generation process. The encryption key shared with the other key generation unit by the key generation process is stored in the encryption key memory 104. A part of the encryption key stored in the encryption key memory 104 is stored in the authentication key memory 103 as a new authentication key, and the remaining encryption key is uploaded to the key management device 200 through the communication unit 105. In addition, when the communication device 100 does not operate normally due to a failure or the like, when the communication device 100 recovers from the failure or is restored by switching to an alternative communication device 100, the authentication key is downloaded from the key management device 200 and stored in the authentication key memory 103, and the key generation unit 101 starts key generation again using the authentication key. The above key generation and key generation start functions can be realized by the processor 106 executing a program stored in the program memory 107.

In addition to the encryption key memory 201 described above, the key management device 200 also has a processor 210, a communication unit 211, and a program memory 212. The processor 210 executes a program stored in the program memory 212 to realize the functions of the remaining amount monitor 204, the key consumption control unit 202, and the recovery control unit 203 described above. When the processor 210 receives an encryption key uploaded from the communication device 100 via the communication unit 211, it stores the encryption key in the encryption key memory 201 and executes the recovery control and key consumption control described below.

2.1) Recovery Control As shown in Fig. 4, the processor 210 judges whether a failure has occurred in the communication device 100 (operation 401). The occurrence of a failure can be judged by a known method, for example, by the presence or absence of reception of a predetermined signal from the communication device 100. If the communication device 100 is operating normally (NO in operation 401), the processor 210 executes key consumption control (described later) (operation 402). If a failure has occurred in the communication device 100 (YES in operation 401), the processor 210 judges whether the communication device 100 has recovered (operation 403).

When switching to an alternative communication device or when communication device 100 has returned to normal operation (YES in operation 403), processor 210 extracts an encryption key of a predetermined length Kth from encryption key memory 01 as an authentication key and downloads it to the restored communication device via communication unit 211 (operation 404). The communication device that downloaded the authentication key can start new key generation using that authentication key. Once normal key generation is resumed in this way, the processor executes the key consumption control described below (operation 402).

2.2) Key Consumption Control As already mentioned, the communication device 100 accumulates the encryption key shared with the other communication device by the key generation process in the encryption key memory 104, holds a part of the accumulated encryption key in the authentication key memory 103 as a new authentication key, and uploads the remaining encryption key to the key management device 200 through the communication unit 105. The processor 210 of the key management device 200 stores the uploaded encryption key in the encryption key memory 201, and controls the key consumption amount so that the remaining amount of the encryption key is always equal to or greater than a predetermined value Kth. Below, the key consumption control will be described using as an example a case where the control threshold values Kth0 and Kth1 are set so that Kth<Kth0<Kth1. Here, Kth0 is the threshold value for stopping key consumption, and Kth1 is the threshold value for suppressing key consumption.

In FIG. 5, the processor 210 determines whether the remaining capacity of the encryption key memory 201 is less than the threshold value Kth1 (operation 501). If the remaining capacity is less than Kth1 (YES in operation 501), the processor 210 determines whether the remaining capacity of the encryption key memory 201 is greater than or equal to the threshold value Kth0 (operation 502). If the remaining capacity is greater than or equal to the threshold value Kth0 (YES in operation 502), the processor 210 controls the encrypted communication device 300 to suppress key consumption (operation 503).

The processor 210 can adjust key consumption by changing the encryption method of the encrypted communication device 300, taking advantage of the fact that the consumption of encryption keys differs depending on the encryption method. For example, in one-time pad (disposable method), the encryption key used by the sender for encryption must always be used by the receiver for decryption, and the encryption key used by the receiver for encryption must always be used by the sender for decryption. In addition, in one-time pad encryption, an encryption key is consumed each time encryption/decryption is performed, and key consumption is greater than in other methods. Therefore, key consumption can be significantly reduced by changing to an encryption method other than one-time pad. Key consumption can also be controlled by changing the key length of the encryption key used.

When the encryption key length and encryption method to be used by the encrypted communication device 300 are set in this manner, the processor 210 extracts the encryption key required for the encrypted communication device 300 from the encryption key memory 201, and sends it to the encrypted communication device 300 via the communication unit 211 (operation 504). While key consumption is being suppressed, the key generation unit 101 of the communication device 100 generates an encryption key, which is uploaded to the key management device 200. This slows down the rate at which the remaining capacity of the encryption key memory 201 decreases, making it possible to prevent the remaining capacity of the encryption key 201 from falling below the predetermined value Kth.

When the remaining amount of the encryption key memory 201 falls below the threshold value Kth0 (NO in operation 502), the processor 210 controls the encrypted communication device 300 to stop key consumption (operation 505). In other words, encrypted communication in the encrypted communication device 300 is stopped until the remaining amount of the key is restored. Note that communication that does not require encryption may be carried out. In this way, by stopping the encryption/decryption operation itself, it is possible to control the remaining amount of the encryption key 201 so that it does not fall below the predetermined value Kth.

If the remaining capacity of the encryption key memory 201 is equal to or greater than the threshold value Kth1 in operation 501 (NO in operation 501), encrypted communication can be performed as needed, and the processor 210 can extract the necessary encryption key using a highly secure encryption method (e.g., one-time pad) and send it to the encrypted communication device 300 (operation 504).

2.3) Example of Key Generation Process The more confidential the key generation method in the key generation unit 101 of the communication device 100, the more desirable it is. In particular, the quantum key distribution (QKD) system is known as an encryption key distribution technology that is absolutely resistant to eavesdropping, and can be adopted as the key generation method in the key generation unit 101. Random numbers generated by QKD are uploaded to the key management device 200, and when a failure is restored, the key management device 200 downloads a part of the uploaded random numbers to the communication device as an authentication key. This makes it possible for the communication device 100 to send an authentication key for starting new key generation without the risk of leakage. In the following, the key generation unit 101 of the communication device 100 is assumed to be a transmitter (Alice), and the key generation unit 101 of the other communication device is assumed to be a receiver (Bob), and a typical quantum cryptography key distribution algorithm called the BB84 protocol will be briefly described (for details of BB84, see, for example, "Quantum Cryptography; Public Key distribution and Coin Tossing" IEEE Int. Conf. on Computers, Systems and Signal Processing, Bangalore, India, December 10-12, 1984, pp.175-179, Bennett, Brassard).

As shown in Figure 6, in QKD, as is well known, key generation unit 101 (Alice) and key generation unit 101 (Bob) connected by optical fiber OpF organize an optical interferometer, and Alice and Bob randomly phase modulate each photon. The difference in the modulation phase depth produces an output of 0 or 1, and then Alice and Bob compare part of the conditions when the output data was measured, so that the same bit string can finally be shared between Alice and Bob. Here, four quantum states are used, and key generation unit 101 (Alice) has two random number sources, one of which, random number 1, represents encryption key data of 0 or 1, and the other, random number 2, determines the method of coding the information of random number 1.

Specifically, in a quantum encryption key distribution method that performs four-state coding using the phase difference between two coherent pulses, two bases are selected using a random number 2: a coding set (hereinafter referred to as "X basis") in which phase 0 represents encryption key "0" and phase π represents encryption key "1", and a coding set (hereinafter referred to as "Y basis") in which phase π/2 represents encryption key "0" and phase 3π/2 represents encryption key "1". In other words, one photon is randomly modulated in four ways: 0, π/2, π, and 3π/2, and then transmitted to the key generation unit 101 (Bob).

The key generation unit 101 (Bob) has a random number source (random number 3) that corresponds to the basis, and decodes the photon sent from the key generation unit 101 (Alice). If the value of random number 3 is "0", the photon is modulated with a phase of 0 (X basis), and if it is "1", it is modulated with a phase of π/2 (Y basis). Here, the random number obtained as the optical interferometer output is called random number 4.

When the modulation bases applied by both key generation unit 101 (Alice) and key generation unit 101 (Bob) are the same (random number 2 = random number 3), key generation unit 101 (Bob) can correctly detect the value of random number 1 (random number 1 = random number 4), and when they are different (random number 2 ≠ random number 3), key generation unit 101 (Bob) randomly obtains the value 0/1 as random number 4 regardless of the value of random number 1.

Since random numbers 1/2/3 are all random numbers that change bit by bit, the probability that the bases match and the probability that they do not match are both 50%. However, since the bits that cause the bases to mismatch are deleted by the basis reconciliation in the subsequent stage, key generation unit 101 (Alice) and key generation unit 101 (Bob) can share the 0/1 bit string that corresponds to random number 1.

In this way, the random number shared between key generation unit 101 (Alice) and key generation unit 101 (Bob) is stored as an encryption key in each encryption key memory 104, and as already described, a portion is cut off as an authentication key, and the remainder is uploaded to each key management device 200.

2.4) Key management during failure recovery in QKD system As shown in FIG. 7, the active device 100.1 of the communication device 100A, the alternative device 100.2, the key management device 200A, and the encrypted communication device 300A are installed in station A, and the communication device 100B, the key management device 200B, and the encrypted communication device 300B are installed in station B. The encrypted communication device 300A and the encrypted communication device 300B can communicate through a normal packet network 30. The reference numbers are the same as those in the above embodiment (FIG. 3), and the reference numbers of each block are differentiated from each other by adding "A" or "B" to the end of the block reference numbers. The same reference numbers indicate blocks having the same functions.

The key generation unit 101A.1 in the current device 100.1 of the communication device 100A and the key generation unit 101B.1 of the communication device 100B store the encryption key shared by the above-mentioned QKD in the encryption key memory 104A.1 and 104B.1, respectively, and extract a part of the encryption key as an authentication key to each of the authentication key memories 103A.1 and 103B, respectively, and upload the remaining encryption key to each of the key management devices 200A and 200B. The key management devices 200A and 200B extract the encryption key necessary for encrypted communication from the encryption key stored therein, and send it to each of the encryption communication devices 300A and 300B. Each of the encryption communication devices 300A and 300B encrypts the transmission data with the encryption key sent thereto, or decrypts the data received from the other side with the same encryption key. As described above, the key management devices 200A and 200B control the key consumption of the respective encrypted communication devices 300A and 300B. That is, the cryptographic memories 201A and 201B in the key management devices 200A and 200B can retain at least a predetermined amount Kth of cryptographic keys by the key consumption control shown in FIG. 5.

When the active device 100.1 breaks down and is switched to the alternative device 100.2, the key management device 200A downloads a predetermined amount of the encryption key remaining in the encryption memory 201A to the alternative device 100.2 as an authentication key, and the alternative device 100.2 stores the authentication key in the authentication key memory 103A.2. Similarly, the key management device 200B downloads a predetermined amount of the encryption key remaining in the encryption memory 201B to the communication device 100B as an authentication key, and the communication device 100B stores the authentication key in the authentication key memory 103B. In this way, the key generation unit 101A.2 of the alternative device 100.2 and the key generation unit 101B of the communication device 100B can authenticate each other using the same authentication key and start a predetermined key generation process. In other words, the authentication key can be updated and the encrypted communication devices 300A and 300B can perform encrypted communication using the encryption key shared between the alternative device 100.2 and the communication device 100B.

2.5) Effects As described above, according to this embodiment, the remaining capacity of the encryption key memory 201A of the key management device 200A in the station A and the remaining capacity of the encryption key memory 201B of the key management device 200B in the station B are maintained at the same random number equal to or greater than the predetermined remaining capacity Kth, so that each remaining key can be used as an authentication key for starting new key generation. Therefore, even if the active device 100.1 is switched to the substitute device 100.2 due to a failure in the active device 100.1, the encryption key required for authentication can be extracted from the remaining keys in the encryption key memories 201A and 201B and downloaded to the substitute device 100.2 and the communication device 100B. In this way, it becomes possible to start key generation again between the key generation unit 101A.2 and the key generation unit 101B.

3. Supplementary Notes A part or all of the above-described embodiment and examples may be described as the following supplementary notes, but the present invention is not limited to these.
(Appendix 1)
An encryption key management device that manages communication devices that generate and share encryption keys consumed in encrypted communication, comprising:
a storage unit for storing encryption keys that have been generated in the communication device and remain unconsumed;
a control unit that controls key consumption so that the encryption key does not become equal to or smaller than a predetermined amount;
a recovery control unit that returns a predetermined amount of encryption keys remaining in the storage unit as authentication keys to a communication device that has recovered from a failure;
1. An encryption key management device comprising:
(Appendix 2)
2. The encryption key management device according to claim 1, wherein the control unit extracts an encryption key to be consumed in the encrypted communication from the encryption key stored in the memory unit.
(Appendix 3)
The encryption key management device described in Appendix 1 or 2, characterized in that the control unit stops the key consumption when the remaining amount of the encryption key stored in the memory unit falls below a first threshold value that is greater than the predetermined amount.
(Appendix 4)
The encryption key management device described in Appendix 1 or 2, characterized in that the control unit suppresses the key consumption when the remaining amount of the encryption key stored in the memory unit is between a first threshold value greater than the specified amount and a second threshold value greater than the first threshold value.
(Appendix 5)
The encryption key management device described in any one of Appendices 1-4, characterized in that when the communication device that has recovered from the failure is successful in authentication using the authentication key, it begins generating an encryption key to be shared with the other communication device.
(Appendix 6)
The encryption key management device according to any one of claims 1 to 5, wherein the communication device that has recovered from the failure is provided as an alternative communication device when a failure occurs in a currently used communication device.
(Appendix 7)
The encryption key management device according to any one of claims 1 to 6, wherein the communication device generates an encryption key shared with a counterpart communication device by quantum key distribution (QKD).
(Appendix 8)
A communication device managed by a key management device,
a key generation unit that generates an encryption key to be used in encrypted communication with another communication device;
a first storage unit for storing an encryption key shared with the other communication device;
a second storage unit for storing an authentication key generated by the key generation unit;
a control unit that controls the key generation unit, the first storage unit, and the second storage unit;
having
the control unit uploads the remaining encryption key after extracting a portion of the encryption key stored in the first storage unit as the authentication key to the key management device, and when starting a new key generation, downloads a predetermined amount of the uploaded encryption key from the key management device as an authentication key and stores it in the second storage unit, and uses the downloaded authentication key to authenticate key generation by the key generation unit.
A communication device comprising:
(Appendix 9)
9. The communication device according to claim 8, wherein key consumption in the encrypted communication is controlled by the key management device so that the uploaded encryption key does not fall below the predetermined amount.
(Appendix 10)
The communication device described in Appendix 8 or 9, characterized in that when recovering from a failure, if authentication using the downloaded authentication key is successful, generation of an encryption key to be shared with the other communication device is started.
(Appendix 11)
10. The communication device according to claim 8 or 9, which is provided as an alternative communication device when a failure occurs in a currently used communication device.
(Appendix 12)
12. The communication device according to any one of claims 8 to 11, wherein the encryption key shared with the other communication device is generated by quantum key distribution (QKD).
(Appendix 13)
1. An encryption key management method for managing a communication device that generates and shares an encryption key consumed in encrypted communication, comprising:
storing, in a storage unit, an encryption key that has been generated in the communication device and remains unconsumed;
a control unit controls key consumption so that the encryption key does not become equal to or less than a predetermined amount;
a recovery control unit returns a predetermined amount of the encryption key remaining in the storage unit to the communication device that has recovered from the failure as an authentication key;
1. An encryption key management method comprising:
(Appendix 14)
The encryption key management method according to claim 13, wherein the control unit extracts an encryption key consumed in the encrypted communication from the encryption key stored in the memory unit.
(Appendix 15)
The encryption key management method described in Appendix 13 or 14, characterized in that the control unit stops the key consumption when the remaining amount of the encryption key stored in the memory unit falls below a first threshold value greater than the predetermined amount.
(Appendix 16)
The encryption key management method described in Appendix 13 or 14, characterized in that the control unit suppresses the key consumption when the remaining amount of the encryption key stored in the memory unit is between a first threshold value greater than the predetermined amount and a second threshold value greater than the first threshold value.
(Appendix 17)
The encryption key management method according to any one of appendices 13-16, characterized in that, when authentication using the authentication key is successful, the communication device that has recovered from the failure starts generating an encryption key to be shared with the other communication device.
(Appendix 18)
The encryption key management method according to any one of appendices 13 to 17, characterized in that the communication device that has recovered from the failure is provided as an alternative communication device when a failure occurs in a currently used communication device.
(Appendix 19)
The encryption key management method according to any one of appendices 13-18, wherein the communication device generates an encryption key shared with a counterpart communication device by quantum key distribution (QKD).
(Appendix 20)
A method for controlling a communication device managed by a key management device, comprising:
the communication device has a key generation unit that generates an encryption key to be consumed in encrypted communication with another communication device, a first storage unit that stores the encryption key shared with the other communication device, a second storage unit that stores an authentication key generated by the key generation unit, and a control unit that controls the key generation unit, the first storage unit, and the second storage unit;
The control unit:
uploading the remaining encryption key after extracting a part of the encryption key stored in the first storage unit as the authentication key to the key management device;
When starting a new key generation, a predetermined amount of the uploaded encryption key is downloaded from the key management device as an authentication key and stored in the second storage unit;
The downloaded authentication key is used to authenticate key generation by the key generation unit.
A method for controlling a communication device comprising:
(Appendix 21)
21. The method for controlling a communication device according to claim 20, wherein key consumption in the encrypted communication is controlled by the key management device so that the uploaded encryption key does not fall below the predetermined amount.
(Appendix 22)
A control method for a communication device described in Appendix 20 or 21, characterized in that when recovery from a failure is achieved and authentication using the downloaded authentication key is successful, generation of an encryption key to be shared with the other communication device is started.
(Appendix 23)
22. The method for controlling a communication device according to claim 20 or 21, characterized in that the communication device is provided as an alternative communication device when a failure occurs in a currently used communication device.
(Appendix 24)
The method for controlling a communication device according to any one of appendices 20 to 23, further comprising generating a cryptographic key shared with the other communication device by quantum key distribution (QKD).
(Appendix 25)
A program that causes a computer to function as an encryption key management device that manages a communication device that generates and shares an encryption key consumed in encrypted communication, comprising:
a function of storing in a storage unit any encryption keys that have been generated and remain unconsumed in the communication device;
a function of controlling key consumption so that the encryption key does not become equal to or smaller than a predetermined amount;
a function of returning a predetermined amount of encryption keys remaining in the storage unit as authentication keys to a communication device that has recovered from a failure;
A program for causing the computer to execute the above.
(Appendix 26)
A program for causing a computer to function as a communication device managed by a key management device,
the communication device has a key generation unit that generates an encryption key to be consumed in encrypted communication with another communication device, a first storage unit that stores the encryption key shared with the other communication device, a second storage unit that stores an authentication key generated by the key generation unit, and a control unit that controls the key generation unit, the first storage unit, and the second storage unit;
The control unit:
uploading the remaining encryption key after extracting a part of the encryption key stored in the first storage unit as the authentication key to the key management device;
When starting a new key generation, a predetermined amount of the uploaded encryption key is downloaded from the key management device as an authentication key and stored in the second storage unit;
The downloaded authentication key is used to authenticate key generation by the key generation unit.
A program for causing the computer to function in such a manner.
(Appendix 27)
1. A cryptographic key management system comprising:
A communication device that generates and shares an encryption key consumed in encrypted communication;
A management device that manages the communication device;
The management device includes:
a storage unit for storing encryption keys that have been generated in the communication device and remain unconsumed;
a control unit that controls key consumption so that the encryption key does not become equal to or smaller than a predetermined amount;
a recovery control unit that returns a predetermined amount of encryption keys remaining in the storage unit as authentication keys to a communication device that has recovered from a failure;
1. An encryption key management system comprising:
(Appendix 28)
In the encryption key management system described in Supplementary Note 27, the communication device starts generating an encryption key to be shared with a partner communication device when authentication using the authentication key is successful.
(Appendix 29)
In the encryption key management system described in Supplementary Note 27, the communication device is provided as an alternative communication device when a failure occurs in a currently used communication device.
(Appendix 30)
In the encryption key management system according to any one of Supplementary Notes 27 to 29, the communication device generates an encryption key shared with a counterpart communication device by quantum key distribution (QKD).

The present invention is applicable to key management in quantum key distribution (QKD) systems.

10. Communication Equipment 10.1 Communication Equipment (Current Equipment)
10.2 Communication device (alternative device)
20 Key management device 30 Network 101, 101.1, 101.2 Key generation unit 102, 102.1, 102.2 Encryption communication unit 103 Authentication key memory 104 Encryption key memory 105 Communication unit 106 Processor 107 Program memory 201 Encryption key memory 202 Key consumption control unit 203 Recovery control unit 204 Remaining amount monitor 210 Processor 211 Communication unit 212 Program memory 300, 300A, 300B Encryption communication device

Claims (10)

An encryption key management device that manages communication devices that generate and share encryption keys consumed in encrypted communication, comprising:
a storage unit that receives from the communication device and stores an encryption key remaining after extracting the encryption key as an authentication key from among the encryption keys generated between the communication device and a counterpart communication device ;
a control unit that controls key consumption of the communication device so that the encryption key of the communication device does not become equal to or less than a predetermined amount;
a recovery control unit that returns a predetermined amount of encryption keys from among the encryption keys remaining in the storage unit to the communication device that starts generating an encryption key between the communication device and the other communication device , as a new authentication key;
1. An encryption key management device comprising: The encryption key management device according to claim 1, characterized in that the control unit extracts an encryption key to be consumed in the encrypted communication from the encryption key stored in the memory unit. The encryption key management device according to claim 1 or 2, characterized in that the control unit stops the key consumption when the remaining amount of the encryption key stored in the memory unit falls below a first threshold value that is greater than the predetermined amount. The encryption key management device according to claim 1 or 2, characterized in that the control unit suppresses the key consumption when the remaining amount of the encryption key stored in the memory unit is between a first threshold value larger than the predetermined amount and a second threshold value larger than the first threshold value. An encryption key management device as described in any one of claims 1 to 4, characterized in that a communication device that receives the new authentication key begins generating an encryption key to be shared with a counterpart communication device when authentication using the new authentication key is successful. 6. The encryption key management device according to claim 1, wherein the communication device that receives the new authentication key is a current communication device that has recovered from a failure or an alternative communication device in the event of a failure. 7. The encryption key management device according to claim 1, wherein the encryption key shared with the counterpart communication device is generated by quantum key distribution (QKD). A communication device managed by a key management device,
a key generation unit that generates an encryption key to be used in encrypted communication with another communication device;
a first storage unit for storing an encryption key shared with the other communication device;
a second storage unit for storing an authentication key generated by the key generation unit;
a control unit that controls the key generation unit, the first storage unit, and the second storage unit;
having
the control unit uploads the remaining encryption key after extracting a portion of the encryption key stored in the first storage unit as the authentication key to the key management device, and when starting a new key generation, downloads a predetermined amount of the uploaded encryption key from the key management device as an authentication key and stores it in the second storage unit, and uses the downloaded authentication key to authenticate key generation by the key generation unit.
A communication device comprising: 1. An encryption key management method for managing a communication device that generates and shares an encryption key consumed in encrypted communication, comprising:
storing, in a storage unit, an encryption key remaining after extracting the authentication key from among the encryption keys generated between the communication device and the other communication device ;
a control unit controls key consumption of the communication device so that the encryption key of the communication device does not become equal to or less than a predetermined amount;
the restoration control unit returns a predetermined amount of encryption keys from the encryption keys remaining in the storage unit as new authentication keys to the communication device that starts generating an encryption key with the other communication device ;
1. An encryption key management method comprising: A program that causes a computer to function as an encryption key management device that manages a communication device that generates and shares an encryption key consumed in encrypted communication, comprising:
a function of storing in a storage unit, the encryption key remaining after extracting the authentication key from among the encryption keys generated between the communication device and the other communication device ;
a function of controlling key consumption of the communication device so that the encryption key of the communication device does not become equal to or less than a predetermined amount;
a function of returning a predetermined amount of encryption keys from the encryption keys remaining in the storage unit as new authentication keys to a communication device that starts generating an encryption key between the communication device and the other communication device ;
A program for causing the computer to execute the above.

Images