Communication system, node device, communication terminal, key management method, and non-transitory computer-readable medium in which program is stored

This application is a national stage application of International Application No. PCT/JP2016/000734 entitled “COMMUNICATION SYSTEM, NODE DEVICE, COMMUNICATION TERMINAL, KEY MANAGEMENT METHOD, AND NON-TRANSITORY COMPUTER-READABLE MEDIUM IN WHICH PROGRAM IS STORED,” filed on Feb. 12, 2016, which claims the benefit of the priority of Japanese Patent Application No. 2015-027356 filed on Feb. 16, 2015, the disclosures of each of which are hereby incorporated by reference in their entirety.

The present invention relates to communication systems, node devices, communication terminals, key management methods, and programs and in particular relates to a technique for managing keys used in group communication.

In recent years, use of communication terminals such as cellular phones and smartphones has spread rapidly, and there are even cases where a single user owns a plurality of communication terminals. Furthermore, it is expected that, aside from communication terminals owned by users, use of M2M (Machine to Machine) terminals that autonomously communicate with other communication devices will increase in the future. M2M terminals are referred to as MTC (Machine Type Communication) devices in 3GPP (3rd Generation Partnership Project). An M2M terminal may, for example, be a vending machine provided with a communication function or may be a sensor device or the like having a communication function. An M2M terminal needs to be authenticated when communicating via a network, similarly to a cellular phone or the like. Aside from an increase in the use of M2M terminals, an increase in the use of wearable terminals, spread of networked consumer electrical appliances within households, and so on are expected in the future. It is assumed that a single user will own a plurality of wearable terminals. Examples of networked consumer electrical appliances include air conditioners, cleaning robots, and refrigerators.

Procedures pertaining to such above authentication are disclosed, for example, in NPL 1 and NPL 2. NPL 1 defines an authentication procedure in the LTE (Long Term Evolution) system, and NPL 2 defines an authentication procedure in the 3G system.

In 3GPP, it is being considered to group together a plurality of communication terminals to carry out group communication. In group communication, a key for establishing secure communication between a communication group to which communication terminals belong and a network (hereinafter, may be referred to as a “group key”) needs to be used.

NPL 3 discloses a technique for managing such a group key. According to NPL 3, generally, a network generates a group key and distributes the group key to each communication terminal.

Non Patent Literature

NPL 1: 3GPP TS 33.401, “3GPP System Architecture Evolution (SAE); Security architecture (Release 12),” V12.13.0, Chapters 6 and 7, December, 2014

NPL 2: 3GPP TS 33.102, “3G Security; Security architecture (Release 12),” V12.2.0, Chapter 6, December, 2014

NPL 3: 3GPP TR 33.833, “Study on Security issues to support Proximity Services (ProSe) (Release 13),” V1.2.0, Sections 6.3.2 to 6.3.5, November, 2014

Technical Problem

However, the inventors of the present application have found that the technique disclosed in NPL 3 has an issue in that the security pertaining to the group key management is insufficient. Specifically, according to NPL 3, the group key itself is distributed from the network to the communication terminals. If the group key leaks, for example, to a malicious third party, the group communication may not be protected and may be listened to.

Accordingly, the present invention is directed to managing a key used in group communication more securely.

Solution to Problem

In order to achieve the above, a communication system according to a first aspect of the present invention includes a plurality of communication terminals that form a communication group, and a node device that carries out an authentication process on each of the communication terminals. The node device derives first keys unique to the respective communication terminals by using information shared between the node device and each communication terminal through the authentication process, derives a second key common to the communication group, calculates an exclusive OR between each first key and the second key, and transmits respective XOR (Exclusive OR) value obtained through the calculation to the respective communication terminals. Each communication terminal reproduces the second key by calculating an exclusive OR of between the first key unique to the own communication terminal derived by using the information and the XOR value received from the node device.

A node device according to a second aspect of the present invention is a node device that carries out an authentication process on each of a plurality of communication terminals that form a communication group. This node device includes a deriving unit that derives first keys unique to respective communication terminals by using information shared between the node device and each communication terminal through the authentication process and derives a second key common to the communication group, a calculating unit that calculates an exclusive OR of between each first key and the second key, and a transmitting unit that transmits the respective XOR values obtained by the calculating unit to the respective communication terminals.

A communication terminal according to a third aspect of the present invention is a communication terminal that forms a communication group together with another communication terminal. This communication terminal includes a deriving unit that derives a first key unique to the own communication terminal by using information shared between the communication terminal and a node device through an authentication process on the own communication terminal, a receiving unit that receives an XOR value from the node device, and a reproducing unit that reproduces a second key common to the communication group by calculating an exclusive OR between the first key and the XOR value. The XOR value is obtained by the node device calculating an exclusive OR between the first key and the second key.

A key management method according to a fourth aspect of the present invention is a method executed in a node device that carries out an authentication process on each of a plurality of communication terminals that form a communication group. This key management method includes deriving first keys unique to the respective communication terminals by using information shared between the node device and each communication terminal through the authentication process, deriving a second key common to the communication group, calculating an exclusive OR between each first key and the second key, and transmitting respective XOR value obtained in the calculating to the respective communication terminals.

A key management method according to a fifth aspect of the present invention is a method executed in a communication terminal that forms a communication group together with another communication terminal. This key management method includes deriving a first key unique to the communication terminal by using information shared between the communication terminal and a node device through an authentication process on the communication terminal, receiving an XOR value from the node device, and reproducing a second key common to the communication group by calculating an exclusive OR between the first key and the XOR value. The XOR value is obtained by the node device calculating an exclusive OR between the first key and the second key.

A program according to a sixth aspect of the present invention is a program to be executed by a computer that is a node device that carries out an authentication process on each of a plurality of communication terminals that form a communication group. This program causes the computer to execute a process of deriving first keys unique to the respective communication terminals by using information shared between the node device and each communication terminal through the authentication process, a process of deriving a second key common to the communication group, a process of calculating an exclusive OR between each first key and the second key, and a process of transmitting respective XOR values obtained in the calculating to the respective communication terminals.

A program according to a seventh aspect of the present invention is a program to be executed by a computer that is a communication terminal that forms a communication group together with another communication terminal. This program causes the computer to execute a process of deriving a first key unique to the communication terminal by using information shared between the communication terminal and a node device through an authentication process on the communication terminal, a process of receiving an XOR value from the node device, and a process of reproducing a second key common to the communication group by calculating an exclusive OR between the first key and the XOR value. The XOR value is obtained by the node device calculating an exclusive OR between the first key and the second key.

Advantageous Effects of Invention

According to the present invention, a key used in group communication can be managed more securely, and thus the problem described above can be solved.

FIG. 1 is a block diagram illustrating a configuration example of a communication system according to Embodiment 1.

FIG. 2 is a block diagram illustrating a configuration example of a node device according to Embodiment 1.

FIG. 3 illustrates an example of an arithmetic operation process in the node device according to Embodiment 1.

FIG. 4 is a block diagram illustrating a configuration example of a communication terminal according to Embodiment 1.

FIG. 5 illustrates an example of an arithmetic operation process in the communication terminal according to Embodiment 1.

FIG. 6 is a block diagram illustrating a configuration example of a communication system according to Embodiment 2.

FIG. 7 is a sequence diagram illustrating an operation example of the communication system according to Embodiment 2.

FIG. 8 is a block diagram illustrating a configuration example of a communication system according to Embodiment 3.

FIG. 9 is a sequence diagram illustrating an operation example of the communication system according to Embodiment 3.

FIG. 10 is a block diagram illustrating a configuration example of a communication system according to Embodiment 4.

FIG. 11 is a sequence diagram illustrating an operation example of a communication system according to Embodiment 5.

FIG. 12 is a sequence diagram illustrating an operation example of a communication system according to Embodiment 6.

Hereinafter, Embodiments 1 to 6 according to the present invention will be described with reference to the drawings. It is to be noted that identical reference characters are given to identical elements in the drawings, and duplicate descriptions will be omitted as necessary in order to make the description clear.

<Embodiment 1>

As illustrated in FIG. 1 , a communication system according to the present embodiment includes a plurality of communication terminals 10 _ 1 to 10 _n(n is an integer no smaller than 2) and a node device 20 .

The communication terminals 10 _ 1 to 10 _n form a communication group 100 and thus receive a variety of services that use group communication. The communication terminals 10 _ 1 to 10 _nmay, for example, be cellular phones, smartphones, M2M terminals, computer devices having a communication function, or the like. The terminals that form the communication group 100 may, for example, be a plurality of wearable terminals worn by a user, networked consumer electrical appliances installed within a household, sensors and meters installed within a building, communication terminals used within a family or a certain group, vending machines managed by a manufacturer, or the like. The communication terminals 10 _ 1 to 10 _n communicate with the node device 20 via a base station 300 . The communication terminals 10 _ 1 to 10 _n are connected to the base station 300 primarily wirelessly but may instead be connected to the base station 300 via cables. The base station 300 is connected to the node device 20 primarily via a cable but may instead be connected to the node device 20 wirelessly. In the following descriptions, the communication terminals 10 _ 1 to 10 _n may be collectively designated by the reference numeral 10 .

Services that use group communication include, for example, a broadcast distribution service to members within the communication group 100 . In other words, the communication terminals 10 _ 1 to 10 _n that belong to the communication group 100 can receive the same information simultaneously. Alternatively, a smartphone, a wearable device, and so on owned by a user may belong to the communication group 100 , and the same information may be transmitted to the smartphone, the wearable device, and so on. Alternatively, the communication terminals 10 _ 1 to 10 _n may be present at locations that are far away from one another and can receive the same information at such remote locations.

The node device 20 carries out an authentication process on the communication terminals 10 . The node device 20 may, for example, be MME (Mobility Management Entity), SGSN (Serving GPRS (General Packet Radio Service) Support Node), or the like that is defined in 3GPP as a device that executes an authentication process on UE (User Equipment).

The node device 20 executes, as an operation characteristic of the present embodiment, a variety of processes in order to securely manage keys used in group communication.

Specifically, as illustrated in FIG. 2 , the node device 20 includes a deriving unit 21 , a calculating unit 22 , and a transmitting unit 23 .

The deriving unit 21 derives keys unique to the respective communication terminals 10 _ 1 to 10 _n (hereinafter, referred to as “group device keys”) by using information shared between the node device 20 and each of the communication terminals 10 _ 1 to 10 _n through the authentication process (hereinafter, referred to as “shared information”). In addition, the deriving unit 21 derives a key common to the communication group 100 (hereinafter, referred to as a “group key”).

As the shared information, Kasme (Key Access Security Management Entity) can be used when the node device 20 is MME, and CK (Cipher Key) and IK (Integrity Key) can be used when the node device 20 is SGSN. In addition, it would suffice if different group device keys are derived for the respective communication devices, and a variety of algorithms can be employed to derive the group device keys. An example of such an algorithm can be KDF (Key Derivation Function) defined by 3GPP. Furthermore, it would suffice if the group key is unique to the communication group 100 , and a random numerical value can, for example, be used.

The calculating unit 22 calculates the exclusive OR between the group device key and the group key. This calculation process is executed on each communication terminal. For example, as illustrated in FIG. 3 , the deriving unit 21 derives a group device key 201 composed of the bit string “0011 . . . ” and a group key 202 composed of the bit string “0101 . . . ” for a given communication terminal. In this case, the calculating unit 22 obtains an XOR (Exclusive OR or Exclusive disjunction) value 203 composed of the bit string “0110 . . . ” as the result of calculating the exclusive OR. The bit length of each of the group device key 201 , the group key 202 , and the XOR value 203 may be set as desired and may be set in accordance with the communication standards or the like to be employed.

The transmitting unit 23 transmits the XOR values calculated for the respective communication terminals to the respective communication terminals 10 _ 1 to 10 _n.

The deriving unit 21 , the calculating unit 22 , and the transmitting unit 23 can be constituted at least by hardware. Such hardware includes, for example, a transceiver that communicates with the communication terminals 10 and a controller, such as a CPU (Central Processing Unit), that controls the transceiver.

As illustrated in FIG. 4 , the communication terminal 10 includes a deriving unit 11 , a receiving unit 12 , and a reproducing unit 13 .

The deriving unit 11 derives a group device key unique to the own communication terminal 10 by using the shared information described above. At this point, the deriving unit 11 employs an algorithm identical to the one employed by the node device 20 and thus derives a group device key identical to the one derived by the node device 20 . When there are a plurality of candidate algorithms and candidate pieces of information that can be employed, the algorithm and the node device 20 may issue an instruction regarding the information to be employed. Such an instruction can be issued with the use of, for example, KSI (Key Set Identifier) or the like.

The receiving unit 12 receives the XOR value calculated for the own communication terminal 10 from the node device 20 .

The reproducing unit 13 reproduces (derives, acquires) the group key common to the node device 20 by calculating the exclusive OR between the group device key derived by the deriving unit 11 and the XOR value received by the receiving unit 12 . Now, as illustrated in FIG. 5 , the deriving unit 11 derives the group device key 201 composed of the bit string “0011 . . . ” identical to the one illustrated in FIG. 3 , and the receiving unit 12 receives the XOR value 203 composed of the bit string “0110 . . . ” identical to the one illustrated in FIG. 3 . In this case, the reproducing unit 13 obtains the bit string “0101 . . . ” as the result of calculating the exclusive OR. This bit string “0101 . . . ” is identical to the group key 202 illustrated in FIG. 3 .

The deriving unit 11 , the receiving unit 12 , and the reproducing unit 13 can be constituted at least by hardware. Such hardware includes, for example, a transceiver that communicates with the node device 20 and a controller, such as a CPU, that controls the transceiver.

As described thus far, in the present embodiment, the group key is shared between the node device 20 and the communication terminal 10 without being distributed from the node device 20 to the communication terminal 10 . Thus, the group key will not leak to a third party, and as a result group communication cannot be listened to. Therefore, according to the present embodiment, the group key can be managed more securely than in the prior art techniques such as the one disclosed in NPL 3.

In addition, even if an XOR value leaks out, the group key cannot be reproduced with the XOR value alone, as described above. Thus, it is extremely difficult for a third party to reproduce the group key. As will be described later, the XOR value may be encrypted and transmitted from the node device 20 to the communication terminal 10 . This makes it even more difficult for a third party to reproduce the group key.

<Embodiment 2>

In the present embodiment, generally, the concept described in Embodiment 1 above is applied to the LTE system.

As illustrated in FIG. 6 , a communication system according to the present embodiment includes a plurality of devices 30 _ 1 to 30 _n (hereinafter, may be collectively designated by the reference numeral 30 ), an eNB (evolved Node B) 40 , which is a type of a wireless base station, and an MME 50 . The devices 30 _ 11 to 30 _n correspond to the communication terminals 10 _ 11 to 10 _n illustrated in FIG. 1 and can be configured similarly to the communication terminal 10 illustrated in FIG. 4 except in that the devices 30 _ 11 to 30 _n execute a process pertaining to signaling compliant with the LTE standards and so on. The MME 50 corresponds to the node device 20 illustrated in FIG. 1 and can be configured similarly to the node device 20 illustrated in FIG. 2 except in that the MME 50 executes a process pertaining to signaling compliant with the LTE standards and so on. Traffic between the device 30 and the MME 50 is transmitted via a wireless link between the device 30 and the eNB 40 and via a backhaul link between the eNB 40 and the MME 50 . The example illustrated in FIG. 6 deals with a case in which the devices 30 _ 11 to 30 _n wirelessly connect to the same eNB 40 , but the devices 30 _ 11 to 30 _n may wirelessly connect to mutually different eNBs.

In operation, as illustrated in FIG. 7 , first, each of the devices 30 _ 11 to 30 _n transmits an Attach Request message to the MME 50 via the eNB 40 and thus requests for attachment to the MME 50 (step S 11 ). Then, an authentication process, or in other words, AKA (Authentication and Key Agreement) Procedure as disclosed in NPL 1 is executed on each of the devices 30 _ 1 to 30 _n with the MME 50 leading the process (step S 12 ). The success of this AKA Procedure allows each of the devices 30 _ 1 to 30 _n and the MME 50 to share Kasme. For example, the device 30 _ 1 shares Kasme_ 1 with the MME 50 and the device 30 _ 2 shares Kasme_ 2 (different from Kasme_ 1 ) with the MME 50 .

The devices 30 _ 1 to 30 _n derive respective group device keys 201 _ 1 to 201 _n unique to the devices from Kasme_ 1 to Kasmen_n (step S 13 ).

Meanwhile, the MME 50 verifies whether each of the devices 30 _ 1 to 30 _n can receive a service that uses group communication (step S 14 ). Such verification may be carried out, for example, on the basis of subscription information of the devices 30 _ 1 to 30 _n, a network policy, or the like. Upon the verification having been successful, the MME 50 derives the group device keys 201 _ 1 to 201 _n unique to the devices 30 _ 1 to 30 _n from Kasme_ 1 to Kasmen_ n and derives a group key 202 (e.g., random numerical value) common to a communication group 110 to which the devices 30 _ 1 to 30 _n belong (step S 15 ).

In addition, the MME 50 calculates the exclusive OR between each of the group device keys 201 _ 1 to 201 _n and the group key 202 and thus obtains XOR values 203 _ 1 to 203 _n (step S 16 ).

Then, the MME 50 transmits an Attach Response message containing the XOR values 203 _ 1 to 203 _n to the respective devices 30 _ 1 to 30 _n via the eNB 40 (step S 17 ).

At this point, the MME 50 encrypts the XOR values 203 _ 1 to 203 _n and embeds them into the Attach Response message. For encryption, NAS (Non Access Stratum) security context shared between each of the devices 30 _ 1 to 30 _n and the MME 50 in AKA Procedure can be used. The NAS security context includes NAS keys, and the NAS keys are used to protect the integrity and the confidentiality of the traffic between UE and the MME. The MME 50 may embed the encrypted XOR values 203 _ 1 to 203 _n into a message (e.g., a new message) different from the Attach Response message.

Upon receiving the Attach Response message, the devices 30 _ 1 to 30 _n decrypt the XOR values 203 _ 1 to 203 _n by using the NAS security context described above and calculate the exclusive OR between the group device keys 201 _ 1 to 201 _n and the respective XOR values 203 _ 1 to 203 _n. Thus, the group key 202 is reproduced in each of the devices 30 _ 1 to 30 _n and is thus shared between each of the devices 30 _ 1 to 30 _n and the MME 50 (step S 18 ). The principle with which the group key is reproduced in the devices is similar to the principle described above with reference to FIG. 3 and FIG. 5 .

According to the present embodiment, a group key can be managed securely in the LTE system similarly to Embodiment 1 described above. In addition, the security in the group key management can be further improved through the encryption of the XOR values.

<Embodiment 3>

In the present embodiment, generally, the concept described in Embodiment 1 above is applied to the 3G system.

As illustrated in FIG. 8 , a communication system according to the present embodiment includes a plurality of devices 30 _ 1 to 30 _n, an NB (Node B) 60 , which is a type of a wireless base station, an RNC (Radio Network Controller) 70 that controls the NB 60 , and an SGSN 80 . The devices 30 _ 1 to 30 _n correspond to the communication terminals 10 _ 1 to 10 _n illustrated in FIG. 1 and can be configured similarly to the communication terminal 10 illustrated in FIG. 4 except in that the devices 30 _ 1 to 30 _n execute a process pertaining to signaling compliant with the 3G standards and so on. The SGSN 80 corresponds to the node device 20 illustrated in FIG. 1 and can be configured similarly to the node device 20 illustrated in FIG. 2 except in that the SGSN 80 executes a process pertaining to signaling compliant with the 3G standards and so on. Traffic between the device 30 and the SGSN 80 is transmitted via a wireless link between the device 30 and the NB 60 and via a backhaul link between the NB 60 , the RNC 70 , and the SGSN 80 . The example illustrated in FIG. 8 deals with a case in which the devices 30 _ 1 to 30 _n wirelessly connect to the same NB 60 , but the devices 30 _ 1 to 30 _n may wirelessly connect to mutually different NBs.

In operation, as illustrated in FIG. 9 , first, each of the devices 30 _ 1 to 30 _n transmits an Attach Request message to the SGSN 80 via the RNC 70 (and the NB 60 (not illustrated)) and thus requests for attachment to the SGSN 80 (step S 21 ). Then, an authentication process, or in other words, AKA Procedure as disclosed in NPL 2 is executed on each of the devices 30 _ 1 to 30 _n with the SGSN 80 leading the process (step S 22 ). The success of this AKA Procedure allows each of the devices 30 _ 1 to 30 _n and the SGSN 80 to share CK and IK. For example, the device 30 _ 1 shares CK_ 1 and IK_ 1 with the SGSN 80 , and the device 30 _ 2 shares CK_ 2 and IK_ 2 (different from CK_ 1 and IK_ 1 , respectively) with the SGSN 80 .

The devices 30 _ 1 to 30 _n derive respective group device keys 201 _ 1 to 201 _n unique to the devices from CK_ 1 to CK_n and IK_ 1 to IK_n (step S 23 ).

Meanwhile, the SGSN 80 verifies whether each of the devices 30 _ 1 to 30 _n can receive a service that uses group communication (step S 24 ). Such verification may be carried out, for example, on the basis of subscription information of the devices 30 _ 1 to 30 _n, a network policy, or the like. Upon the verification having been successful, the SGSN 80 derives the group device keys 201 _ 1 to 201 _n unique to the respective devices 30 _ 1 to 30 _nfrom CK_ 1 to CK_n and IK_ 1 to IK_n and derives a group key 202 (e.g., random numerical value) common to a communication group 110 to which the devices 30 _ 1 to 30 _n belong (step S 25 ).

In addition, the SGSN 80 calculates the exclusive OR between each of the group device keys 201 _ 1 to 201 _n and the group key 202 and thus obtains XOR values 203 _ 1 to 203 _n (step S 26 ).

Then, the SGSN 80 transmits an Attach Response message containing the XOR values 203 _ 1 to 203 _n to the respective devices 30 _ 1 to 30 _n via the RNC 70 (step S 27 ).

At this point, the SGSN 80 encrypts the XOR values 203 _ 1 to 203 _n and embeds them into the Attach Response message. For encryption, UMTS (Universal Mobile Telecommunications System) security context shared between each of the devices 30 _ 1 to 30 _n and the SGSN 80 in AKA Procedure can be used. The UMTS security context includes UMTS keys, and the UMTS keys are used to protect the integrity and the confidentiality of the traffic between UE and the SGSN. The SGSN 80 may embed the encrypted XOR values 203 _ 1 to 203 _n into a message (e.g., a new message) different from the Attach Response message.

Upon receiving the Attach Response message, the devices 30 _ 1 to 30 _n decrypt the XOR values 203 _ 1 to 203 _n by using the UMTS security context described above and calculate the exclusive OR between the group device keys 201 _ 1 to 201 _n and the respective XOR values 203 _ 1 to 203 _n. Thus, the group key 202 is reproduced in each of the devices 30 _ 1 to 30 _n and is thus shared between each of the devices 30 _ 1 to 30 _n and the SGSN 80 (step S 28 ). The principle with which the group key is reproduced in the devices is similar to the principle described above with reference to FIG. 3 and FIG. 5 .

According to the present embodiment, a group key can be managed securely in the 3G system similarly to Embodiment 1 described above. In addition, the security in the group key management can be further improved through the encryption of the XOR values.

<Embodiment 4>

As illustrated in FIG. 10 , a communication system according to the present embodiment differs from Embodiment 1 described above in that a master device (also referred to as a base unit, a base device, or the like) 90 is provided in addition to the configuration of the communication system illustrated in FIG. 1 .

The master device 90 is one communication terminal that represents a communication group 100 . The master device 90 may, for example, be a cellular phone, a smartphone, an M2M terminal, a computer device having a communication function, or the like. Alternatively, the master device 90 may be a mobile router. When the master device 90 is a mobile router, a cellular phone, a smartphone, an M2M terminal, or the like, the master device 90 is connected to a base station 300 wirelessly as illustrated in FIG. 10 . However, when the master device 90 is a stationary wireless router or the like, the master device 90 is connected to the base station 300 via a cable.

In operation, the master device 90 receives, from a node device 20 , XOR values calculated for respective communication terminals (also referred to as handsets, slaves, or the like) 10 _ 1 to 10 _n and distributes the received XOR values to the communication terminals 10 _ 1 to 10 _n. Meanwhile, similarly to Embodiment 1 described above, the communication terminals 10 _ 1 to 10 _n are individually authenticated by the node device 20 , and a deriving unit 11 (refer to FIG. 4 ) of each of the communication terminals 10 _ 1 to 10 _n derives a group device key by using the shared information described above. Then, a receiving unit 12 receives the XOR value distributed by the master device 90 , and a reproducing unit 13 reproduces a group key by calculating the exclusive OR between the group device key derived by the deriving unit 11 and the XOR value received by the receiving unit 12 .

In this manner, in the present embodiment, the master device 90 receives the XOR values from the node device 20 , representing the communication group 110 . Thus, the amount of signaling required for transmitting the XOR values can be reduced as compared to Embodiment 1 described above. Similarly to Embodiment 1 described above, the group key is of course not distributed from the node device 20 to the communication terminal 10 , and thus the group key can be managed securely as well.

The communication between the master device 90 and the communication terminal 10 may be carried out in compliance with a desired communication protocol. The master device 90 may, for example, communicate with the communication terminal 10 via wireless LAN (Local Area Network) communication or may communicate with the communication terminal 10 via near-field wireless communication, such as Bluetooth (registered trademark) or NFC (Near Field Communication). When the communication terminal 10 is located at a remote location, the master device 90 may communicate with the communication terminal 10 via a mobile network.

<Embodiment 5>

In the present embodiment, generally, both the concept described in Embodiment 1 above and the concept described in Embodiment 4 above are applied to the LTE system.

Although not illustrated, a communication system according to the present embodiment can be configured similarly to the communication system illustrated in FIG. 6 except in that a master device 90 is interposed between devices 30 _ 1 to 30 _n and an eNB 40 .

In operation, as illustrated in FIG. 11 , first, in order to execute an authentication process for carrying out normal communication via a mobile network in the master device 90 and an MME 50 , the MME 50 transmits an Authentication Request message to the master device 90 (step S 31 ). At this point, the MME 50 embeds AV (Authentication Vector) into the Authentication Request message.

The master device 90 executes a predetermined arithmetic operation by using the AV received from the MME 50 and SIM (Subscriber Identity Module) information and key information of the master device 90 and transmits, to the MME 50 , the result of the arithmetic operation embedded in an Authentication Response message (step S 32 ). The MME 50 executes an authentication process pertaining to the master device 90 by using the result of the arithmetic operation received from the master device 90 and the result of an arithmetic operation in the MME 50 .

Then, in order to execute an authentication process pertaining to a communication group 110 , the master device 90 transmits a Group Authentication Request message to the MME 50 (step S 33 ). At this point, the master device 90 , for example, sets information for identifying the communication group 110 in the Group Authentication Request message. Furthermore, the master device 90 may set identification information of all the devices 30 _ 1 to 30 _n that belong to the communication group 110 in the Group Authentication Request message.

The MME 50 checks the devices (also referred to as handsets, slaves, or the like) 30 _ 1 to 30 _n that belong to the communication group 110 by using the information included in the Group Authentication Request message (step S 34 ).

In addition, similarly to step S 15 in FIG. 7 , the MME 50 derives group device keys 201 _ 1 to 201 _n unique to the respective devices 30 _ 1 to 30 _n from Kasme_ 1 to Kasmen_n and derives a group key 202 (e.g., random numerical value) common to the communication group 110 to which the devices 30 _ 1 to 30 _n belong (step S 35 ).

Furthermore, the MME 50 calculates the exclusive OR between each of the group device keys 201 _ to 201 _n and the group key 202 and thus obtains XOR values 203 _ 1 to 203 _n (step S 36 ).

Then, the MME 50 transmits a Group Authentication Response message containing the XOR values 203 _ 1 to 203 _n to the master device 90 (step S 37 ). At this point, similarly to Embodiment 2 described above, the MME 50 may encrypt the XOR values 203 _ 1 to 203 _n and embed them into the Group Authentication Response message. In that case, the privacy is enhanced, and increased security is ensured. In addition, the MME 50 may embed Group AV associated with the communication group 110 into the Group Authentication Response message. Such Group AV can, for example, be used in the authentication of the devices 30 _ 1 to 30 _n by the master device 90 .

The master device 90 distributes the XOR values 203 _ 1 to 203 _n received from the MME 50 to the devices 30 _ 1 to 30 _n (step S 38 ). In addition, the master device 90 transmits a Group Authentication Confirmation message to the MME 50 (step S 39 ). When authenticating the devices 30 _ 1 to 30 _n, the master device 90 may transmit, to the MME 50 , the result of the authentication embedded in the Group Authentication Confirmation message to make the MME 50 recognize the devices 30 _ 1 to 30 _n that belong to the communication group 110 .

Meanwhile, although not illustrated, the devices 30 _ 1 to 30 _n have been authenticated individually by the MME 50 in the AKA Procedure illustrated in FIG. 7 and share Kasme_ 1 to Kasmen_ n with the MME 50 . Thus, the devices 30 _ 1 to 30 _n derive the respective group device keys 201 _ 1 to 201 _n unique to the devices from Kasme_ 1 to Kasmen_n (step S 40 ).

Then, upon receiving the XOR values 203 _ to 203 _n from the master device 90 in step S 38 described above, the devices 30 _ 1 to 30 _n reproduce the group key 202 by calculating the exclusive OR between the group device keys 201 _ 1 to 201 _n and the respective XOR values 203 _ 1 to 203 _n (step S 41 ). When the XOR values 203 _ 1 to 203 _n are encrypted, the devices 30 _ 1 to 30 _n can decrypt them by using the NAS security context described above.

According to the present embodiment, the amount of signaling required for transmitting the XOR values can be reduced in the LTE system. In addition, the group key can be managed securely similarly to Embodiment 2 described above. Furthermore, the security in the group key management can be further improved through the encryption of the XOR values.

<Embodiment 6>

In the present embodiment, generally, both the concept described in Embodiment 1 above and the concept described in Embodiment 4 above are applied to the 3G system.

Although not illustrated, a communication system according to the present embodiment can be configured similarly to the communication system illustrated in FIG. 8 except in that a master device 90 is interposed between devices 30 _ 1 to 30 _n and an NB 60 .

In operation, as illustrated in FIG. 12 , first, in order to execute an authentication process for carrying out normal communication via a mobile network in the master device 90 and an SGSN 80 , the SGSN 80 transmits an Authentication Request message to the master device 90 (step S 51 ). At this point, the SGSN 80 embeds AV into the Authentication Request message.

The master device 90 executes a predetermined arithmetic operation by using the AV received from the SGSN 80 and SIM information and key information of the master device 90 and transmits, to the SGSN 80 , the result of the arithmetic operation embedded in an Authentication Response message (step S 52 ). The SGSN 80 executes an authentication process pertaining to the master device 90 by using the result of the arithmetic operation received from the master device 90 and the result of an arithmetic operation in the SGSN 80 .

Then, in order to execute an authentication process pertaining to a communication group 110 , the master device 90 transmits a Group Authentication Request message to the SGSN 80 (step S 53 ). At this point, the master device 90 , for example, sets information for identifying the communication group 110 in the Group Authentication Request message. Furthermore, the master device 90 may set identification information of all the devices 30 _ 1 to 30 _n that belong to the communication group 110 in the Group Authentication Request message.

The SGSN 80 checks the devices 30 _ 1 to 30 _n that belong to the communication group 110 by using the information included in the Group Authentication Request message (step S 54 ).

In addition, similarly to step S 25 in FIG. 9 , the SGSN 80 derives group device keys 201 _ 1 to 201 _n unique to the respective devices 30 _ 1 to 30 _n from CK_ 1 to CK_n and IK_ 1 to IK_n and derives a group key 202 (e.g., random numerical value) common to the communication group 110 to which the devices 30 _ 1 to 30 _n belong (step S 55 ).

Furthermore, the SGSN 80 calculates the exclusive OR between each of the group device keys 201 _ 1 to 201 _n and the group key 202 and thus obtains XOR values 203 _ 1 to 203 _n (step S 56 ).

Then, the SGSN 80 transmits a Group Authentication Response message containing the XOR values 203 _ 1 to 203 _n to the master device 90 (step S 57 ). At this point, similarly to Embodiment 3 described above, the SGSN 80 may encrypt the XOR values 203 _ 1 to 203 _n and embed them into the Group Authentication Response message. In that case, the privacy is enhanced, and increased security is ensured. In addition, the SGSN 80 may embed Group AV associated with the communication group 110 into the Group Authentication Response message. Such Group AV can, for example, be used in the authentication of the devices 30 _ 1 to 30 _n by the master device 90 .

The master device 90 distributes the XOR values 203 _ 1 to 203 _n received from the SGSN 80 to the devices 30 _ 1 to 30 _n (step S 58 ). In addition, the master device 90 transmits a Group Authentication Confirmation message to the SGSN 80 (step S 59 ). When authenticating the devices 30 _ 1 to 30 _n, the master device 90 may transmit, to the SGSN 80 , the result of the authentication embedded in the Group Authentication Confirmation message to make the SGSN 80 recognize the devices 30 _ 1 to 30 _n that belong to the communication group 110 .

Meanwhile, although not illustrated, the devices 30 _ 1 to 30 _n have been authenticated individually by the MME 50 in the AKA Procedure illustrated in FIG. 9 and share CK_ 1 to CK_n and IK_ 1 to IK_n with the SGSN 80 . Thus, the devices 30 _ 1 to 30 _n derive the respective group device keys 201 _ 1 to 201 _n unique to the devices from CK_ 1 to CK_n and IK_ 1 to IK_n (step S 60 ).

Then, upon receiving the XOR values 203 _ 1 to 203 _n from the master device 90 in step S 58 described above, the devices 30 _ 1 to 30 _n reproduce the group key 202 by calculating the exclusive OR between the group device keys 201 _ 1 to 201 _n and the respective XOR values 203 _ 1 to 203 _n (step S 61 ). When the XOR values 203 _ 1 to 203 _n are encrypted, the devices 30 _ 1 to 30 _n can decrypt them by using the UMTS security context described above.

According to the present embodiment, the amount of signaling required for transmitting the XOR values can be reduced in the 3G system. In addition, the group key can be managed securely similarly to Embodiment 3 described above. Furthermore, the security in the group key management can be further improved through the encryption of the XOR values.

Although the present invention has been described as a configuration of hardware in the above embodiments, the present invention is not limited thereto. The present invention can also be implemented by causing a CPU to execute a computer program to implement the processes in the communication terminal 10 and the node device 20 .

In this case, the program can be stored with the use of a variety of types of non-transitory computer-readable media (non-transitory computer-readable medium) to be supplied to a computer. The non-transitory computer-readable media include a variety of types of tangible storage media (tangible storage medium). Examples of the non-transitory computer-readable media include a magnetic recording medium (e.g., flexible disk, magnetic tape, hard disk drive), a magneto-optical recording medium (e.g., magneto-optical disk), a CD-ROM (Read Only Memory), a CD-R, a CD-R/W, and a semiconductor memory (e.g., mask ROM, PROM (Programmable ROM), EPROM (Erasable PROM), flash ROM, RAM (Random Access Memory)). In addition, the program may be supplied to a computer in the form of a variety of types of transitory computer-readable media (transitory computer readable medium). Examples of the transitory computer-readable media include an electric signal, an optical signal, and an electromagnetic wave. Transitory computer-readable media can provide the program to a computer via a wired communication line, such as an electric wire and an optical fiber, or via a wireless communication line.

It is to be noted that the present invention is not limited by the embodiments described above, and it is apparent that various changes can be made by a person skilled in the art on the basis of the descriptions in the claims.

This application claims priority to Japanese Patent Application No. 2015-027356, filed on Feb. 16, 2015, and the entire disclosure of which is incorporated herein.

10 communication terminal

11 , 21 deriving unit

12 receiving unit

13 reproducing unit

20 node device

22 calculating unit

23 transmitting unit

30 device

40 eNB

50 MME

60 NB

70 RNC

80 SGSN

90 master device

100 , 110 communication group

201 group device key

202 group key

203 XOR value